ViewerException: There is no report design object available.

[wimjongman]

ViewerException: There is no report design object available.

In case you encounter this issue it is because, by default, it is no longer allowed to fetch report designs from another server. If you were relying on this situation, open the web.xml file and edit the URL_REPORT_PATH_POLICY and URL_REPORT_PATH_DOMAINS settings.

stacktrace

org.eclipse.birt.report.exception.ViewerException: There is no report design object available.

at org.eclipse.birt.report.context.ViewerAttributeBean.__init(ViewerAttributeBean.java:254)

at org.eclipse.birt.report.context.BaseAttributeBean.init(BaseAttributeBean.java:228)

at org.eclipse.birt.report.context.ViewerAttributeBean.<init>(ViewerAttributeBean.java:150)

at org.eclipse.birt.report.context.BirtContext.__init(BirtContext.java:42)

at org.eclipse.birt.report.context.BaseContext.<init>(BaseContext.java:69)

at org.eclipse.birt.report.context.BirtContext.<init>(BirtContext.java:30)

at org.eclipse.birt.report.servlet.ViewerServlet.__getContext(ViewerServlet.java:144)

at org.eclipse.birt.report.servlet.BirtSoapMessageDispatcherServlet.doGet(BirtSoapMessageDispatcherServlet.java:138)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:670)

at org.apache.axis.transport.http.AxisServletBase.service(AxisServletBase.java:332)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:779)

at org.eclipse.birt.report.servlet.BirtSoapMessageDispatcherServlet.service(BirtSoapMessageDispatcherServlet.java:115)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:227)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)

at org.eclipse.birt.report.filter.ViewerFilter.doFilter(ViewerFilter.java:71)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)

at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)

at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:177)

at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)

at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)

at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)

at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)

at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:687)

at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)

at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:360)

at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:399)

at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)

at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:891)

at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1784)

at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)

at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)

at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)

at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)

at java.base/java.lang.Thread.run(Thread.java:833)

Cause

Apart from the report design not being available; since BIRT 4.13 the way remote reports are fetched has been changed.

BIRT enables you to retrieve a report from another host using an absolute http path for the report parameter: __report=http://xyz.com/report.rptdesign. This means that you can host report designs on one server and the ReportViewer web application on another.

e.g. https://reportserver.mydomain.com:8080/birt/frameset?__report=http://otherdomain:8090/birt/test.rptdesign

I some cases this would allow attackers to prepare reports that could execute malicious code on the host of the ReportViewer web application.

A full description of the CVE is here:
https://bugs.eclipse.org/bugs/show_bug.cgi?id=580391

The PR for the fix is here:
#1165