TIKA-4831 - sort slide ids without parsing them as int

A crafted _slide id with more digits than an int holds threw an uncaught
NumberFormatException out of the sort comparator; compare the digit strings
by length then lexicographically instead. The regression test builds a
two-slide container with an oversized id.

Author: dschmidt

tika-parsers/tika-parsers-standard/tika-parsers-standard-modules/tika-parser-miscoffice-module/src/main/java/org/apache/tika/parser/geogebra/GeoGebraParser.java

@@ -192,9 +192,15 @@ private List<String> getSlideIds(ZipFile zipFile) {
                 numericallySorted.add(m.group(1));
             }
         }
-        numericallySorted.sort((a, b) -> Integer.compare(
-                Integer.parseInt(a.substring("_slide".length())),
-                Integer.parseInt(b.substring("_slide".length()))));
+        //compare the digit suffixes numerically without parsing them: a shorter
+        //digit string is the smaller number, equal lengths compare lexicographically.
+        //Parsing would throw for a crafted id with more digits than an int holds.
+        numericallySorted.sort((a, b) -> {
+            String da = a.substring("_slide".length());
+            String db = b.substring("_slide".length());
+            return da.length() != db.length()
+                    ? Integer.compare(da.length(), db.length()) : da.compareTo(db);
+        });
 
         ZipArchiveEntry structure = zipFile.getEntry(STRUCTURE_JSON);
         if (structure == null || numericallySorted.isEmpty()) {

tika-parsers/tika-parsers-standard/tika-parsers-standard-modules/tika-parser-miscoffice-module/src/test/java/org/apache/tika/parser/geogebra/GeoGebraParserTest.java

@@ -20,15 +20,21 @@
 import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
+import java.io.ByteArrayOutputStream;
+import java.nio.charset.StandardCharsets;
 import java.util.List;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipOutputStream;
 
 import org.junit.jupiter.api.Test;
 
 import org.apache.tika.TikaTest;
+import org.apache.tika.io.TikaInputStream;
 import org.apache.tika.metadata.HttpHeaders;
 import org.apache.tika.metadata.Metadata;
 import org.apache.tika.metadata.PagedText;
 import org.apache.tika.metadata.TikaCoreProperties;
+import org.apache.tika.parser.ParseContext;
 
 public class GeoGebraParserTest extends TikaTest {
 
@@ -112,4 +118,33 @@ public void testGGT() throws Exception {
         assertEquals(1, metadataList.size());
         assertNull(metadata.get(TikaCoreProperties.TITLE));
     }
+
+    /**
+     * A crafted slide id can carry more digits than an int holds; sorting the
+     * slide ids must not throw a NumberFormatException out of parse().
+     */
+    @Test
+    public void testSlideNumberLargerThanIntParses() throws Exception {
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        try (ZipOutputStream zos = new ZipOutputStream(bos)) {
+            zos.putNextEntry(new ZipEntry("structure.json"));
+            //two slides so that sorting actually compares the ids
+            zos.write(("{\"chapters\":[{\"pages\":[{\"elements\":"
+                    + "[{\"id\":\"_slide0\"},{\"id\":\"_slide99999999999\"}]}]}]}")
+                    .getBytes(StandardCharsets.UTF_8));
+            zos.closeEntry();
+            zos.putNextEntry(new ZipEntry("_slide0/geogebra.xml"));
+            zos.write("<geogebra format=\"5.0\"></geogebra>".getBytes(StandardCharsets.UTF_8));
+            zos.closeEntry();
+            zos.putNextEntry(new ZipEntry("_slide99999999999/geogebra.xml"));
+            zos.write("<geogebra format=\"5.0\"></geogebra>".getBytes(StandardCharsets.UTF_8));
+            zos.closeEntry();
+        }
+        try (TikaInputStream tis = TikaInputStream.get(bos.toByteArray())) {
+            List<Metadata> metadataList =
+                    getRecursiveMetadata(tis, new Metadata(), new ParseContext(), false);
+            assertEquals("application/vnd.geogebra.slides",
+                    metadataList.get(0).get(HttpHeaders.CONTENT_TYPE));
+        }
+    }
 }