From b81cb91d67432a2cb95c1f91ebd253e4d3b5aa38 Mon Sep 17 00:00:00 2001
From: wylovely <2016688030@qq.com>
Date: Tue, 22 Sep 2026 09:13:12 +0800
Subject: [PATCH 01/18] fix(#790): escape file URL in bpmn.ftl with ?js_string
 to prevent SyntaxError on apostrophe

---
 server/src/main/resources/web/bpmn.ftl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/main/resources/web/bpmn.ftl b/server/src/main/resources/web/bpmn.ftl
index 756562a1b..1b2c523d3 100644
--- a/server/src/main/resources/web/bpmn.ftl
+++ b/server/src/main/resources/web/bpmn.ftl
@@ -41,7 +41,7 @@
     const viewer = new BpmnJS({
         container: '#diagram'
     });
-	var url = '${finalUrl}';
+	var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
     var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
     if (kkagent === 'true' || !url.startsWith(baseUrl)) {

From e34e281461ed30f21dcbe0f7a2313727a5cd5f4e Mon Sep 17 00:00:00 2001
From: wylovely <2016688030@qq.com>
Date: Tue, 22 Sep 2026 09:13:14 +0800
Subject: [PATCH 02/18] fix(#790): escape file URL in csv.ftl with ?js_string
 to prevent SyntaxError on apostrophe

---
 server/src/main/resources/web/csv.ftl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/main/resources/web/csv.ftl b/server/src/main/resources/web/csv.ftl
index 47f7bbbec..549dc0fd0 100644
--- a/server/src/main/resources/web/csv.ftl
+++ b/server/src/main/resources/web/csv.ftl
@@ -35,7 +35,7 @@ var process_wb = (function() {
     if(typeof console !== 'undefined') console.log("output", new Date());
   };
 })();
- var url = '${finalUrl}';
+ var url = '${finalUrl?js_string}';
  var kkagent = '${kkagent}';
  var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
     if (kkagent === 'true' || !url.startsWith(baseUrl)) {

From 73437824bee95404c36c9bb0f93675dd8df3a4ab Mon Sep 17 00:00:00 2001
From: wylovely <2016688030@qq.com>
Date: Tue, 22 Sep 2026 09:13:16 +0800
Subject: [PATCH 03/18] fix(#790): escape file URL in dcm.ftl with ?js_string
 to prevent SyntaxError on apostrophe

---
 server/src/main/resources/web/dcm.ftl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/main/resources/web/dcm.ftl b/server/src/main/resources/web/dcm.ftl
index 80492b226..ef3917089 100644
--- a/server/src/main/resources/web/dcm.ftl
+++ b/server/src/main/resources/web/dcm.ftl
@@ -54,7 +54,7 @@
         <script src="dcm/index.umd.js"></script>
 
         <script>
-       var url = '${finalUrl}';
+       var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
     var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
     if (kkagent === 'true' || !url.startsWith(baseUrl)) {

From 3096ef8368cd34b6199e8b9ac42adf2e02efe8d4 Mon Sep 17 00:00:00 2001
From: wylovely <2016688030@qq.com>
Date: Tue, 22 Sep 2026 09:13:19 +0800
Subject: [PATCH 04/18] fix(#790): escape file URL in drawio.ftl with
 ?js_string to prevent SyntaxError on apostrophe

---
 server/src/main/resources/web/drawio.ftl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/main/resources/web/drawio.ftl b/server/src/main/resources/web/drawio.ftl
index d95aac005..eecade263 100644
--- a/server/src/main/resources/web/drawio.ftl
+++ b/server/src/main/resources/web/drawio.ftl
@@ -16,7 +16,7 @@
     <#assign finalUrl="${baseUrl}${currentUrl}">
 </#if>
   <script>
-    var url = '${finalUrl}';
+    var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
     var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
     if (kkagent === 'true' || !url.startsWith(baseUrl)) {

From ab4542ca65e8b18dfb60ee012b06fcff3832a3a3 Mon Sep 17 00:00:00 2001
From: wylovely <2016688030@qq.com>
Date: Tue, 22 Sep 2026 09:13:22 +0800
Subject: [PATCH 05/18] fix(#790): escape file URL in eml.ftl with ?js_string
 to prevent SyntaxError on apostrophe

---
 server/src/main/resources/web/eml.ftl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/main/resources/web/eml.ftl b/server/src/main/resources/web/eml.ftl
index ff85ac2df..dbd8948a4 100644
--- a/server/src/main/resources/web/eml.ftl
+++ b/server/src/main/resources/web/eml.ftl
@@ -19,7 +19,7 @@
 <iframe src="" width="100%" frameborder="0"></iframe>
 </body>
 <script type="text/javascript">
-   	var url = '${finalUrl}';
+   	var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
     var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
     if (kkagent === 'true' || !url.startsWith(baseUrl)) {

From 94da3209fc2090f0e2292823f14db4c55e3766b6 Mon Sep 17 00:00:00 2001
From: wylovely <2016688030@qq.com>
Date: Tue, 22 Sep 2026 09:13:24 +0800
Subject: [PATCH 06/18] fix(#790): escape file URL in epub.ftl with ?js_string
 to prevent SyntaxError on apostrophe

---
 server/src/main/resources/web/epub.ftl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/main/resources/web/epub.ftl b/server/src/main/resources/web/epub.ftl
index 5502d0b05..87a292ef6 100644
--- a/server/src/main/resources/web/epub.ftl
+++ b/server/src/main/resources/web/epub.ftl
@@ -25,7 +25,7 @@
   <div id="next" class="arrow">›</div>
 </body>
 <script type="text/javascript">
- 	var url = '${finalUrl}';
+ 	var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
     var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
     if (kkagent === 'true' || !url.startsWith(baseUrl)) {

From 29ec82554e1992430644c8135d5d2f4ba14ddb85 Mon Sep 17 00:00:00 2001
From: wylovely <2016688030@qq.com>
Date: Tue, 22 Sep 2026 09:13:26 +0800
Subject: [PATCH 07/18] fix(#790): escape file URL in msg.ftl with ?js_string
 to prevent SyntaxError on apostrophe

---
 server/src/main/resources/web/msg.ftl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/main/resources/web/msg.ftl b/server/src/main/resources/web/msg.ftl
index 4d0028bd9..3f2ff7ea8 100644
--- a/server/src/main/resources/web/msg.ftl
+++ b/server/src/main/resources/web/msg.ftl
@@ -17,7 +17,7 @@
 <iframe src="" width="100%" frameborder="0"></iframe>
 </body>
 <script type="text/javascript">
-   	var url = '${finalUrl}';
+   	var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
     var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
     if (kkagent === 'true' || !url.startsWith(baseUrl)) {

From e8f1fff8796dc45639039d8ae942e452335cf831 Mon Sep 17 00:00:00 2001
From: wylovely <2016688030@qq.com>
Date: Tue, 22 Sep 2026 09:13:30 +0800
Subject: [PATCH 08/18] fix(#790): escape file URL in ofd.ftl with ?js_string
 to prevent SyntaxError on apostrophe

---
 server/src/main/resources/web/ofd.ftl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/main/resources/web/ofd.ftl b/server/src/main/resources/web/ofd.ftl
index b23c33324..60f0a640f 100644
--- a/server/src/main/resources/web/ofd.ftl
+++ b/server/src/main/resources/web/ofd.ftl
@@ -17,7 +17,7 @@
 <iframe src="" width="100%" frameborder="0"></iframe>
 </body>
 <script type="text/javascript">
-    var url = '${finalUrl}';
+    var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
     var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
      

From f47e4b8a96bf3ea8d1b16e5023150b2f1f87db75 Mon Sep 17 00:00:00 2001
From: wylovely <2016688030@qq.com>
Date: Tue, 22 Sep 2026 09:13:32 +0800
Subject: [PATCH 09/18] fix(#790): escape file URL in officeweb.ftl with
 ?js_string to prevent SyntaxError on apostrophe

---
 server/src/main/resources/web/officeweb.ftl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/main/resources/web/officeweb.ftl b/server/src/main/resources/web/officeweb.ftl
index b1ed22276..1602d462f 100644
--- a/server/src/main/resources/web/officeweb.ftl
+++ b/server/src/main/resources/web/officeweb.ftl
@@ -157,7 +157,7 @@
         window.location.href=test;
     }
 
-    var url = '${finalUrl}';
+    var url = '${finalUrl?js_string}';
    	var kkagent = '${kkagent}';
     var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
     if (kkagent === 'true' || !url.startsWith(baseUrl)) {

From 228ac8e3a0f2521fb63b186d7faa2977d30ac267 Mon Sep 17 00:00:00 2001
From: wylovely <2016688030@qq.com>
Date: Tue, 22 Sep 2026 09:13:35 +0800
Subject: [PATCH 10/18] fix(#790): escape file URL in online3D.ftl with
 ?js_string to prevent SyntaxError on apostrophe

---
 server/src/main/resources/web/online3D.ftl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/main/resources/web/online3D.ftl b/server/src/main/resources/web/online3D.ftl
index bdea98409..e8edeadc6 100644
--- a/server/src/main/resources/web/online3D.ftl
+++ b/server/src/main/resources/web/online3D.ftl
@@ -20,7 +20,7 @@
 <iframe src="" width="100%" frameborder="0"></iframe>
 </body>
 <script type="text/javascript">
-    var url = '${finalUrl}';
+    var url = '${finalUrl?js_string}';
     var kkagent = '${kkagent}';
     var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
     if (kkagent === 'true' || !url.startsWith(baseUrl)) {

From 67b71de33032dec21c528d7c7cf10d25655c8673 Mon Sep 17 00:00:00 2001
From: wylovely <2016688030@qq.com>
Date: Tue, 22 Sep 2026 09:13:38 +0800
Subject: [PATCH 11/18] fix(#790): escape file URL in svg.ftl with ?js_string
 to prevent SyntaxError on apostrophe

---
 server/src/main/resources/web/svg.ftl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/main/resources/web/svg.ftl b/server/src/main/resources/web/svg.ftl
index 2ba3da7a0..ee4f3fa3e 100644
--- a/server/src/main/resources/web/svg.ftl
+++ b/server/src/main/resources/web/svg.ftl
@@ -129,7 +129,7 @@
     let isDragging = false;
     let startX, startY, startTranslateX, startTranslateY;
     let panStartX, panStartY;
-	var url = '${finalUrl}';
+	var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
     var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
     if (kkagent === 'true' || !url.startsWith(baseUrl)) {

From 7a2250cc6221dce28c55eddea0eb7d3c834653a8 Mon Sep 17 00:00:00 2001
From: wylovely <2016688030@qq.com>
Date: Tue, 22 Sep 2026 09:13:42 +0800
Subject: [PATCH 12/18] fix(#790): escape file URL in tiff.ftl with ?js_string
 to prevent SyntaxError on apostrophe

---
 server/src/main/resources/web/tiff.ftl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/main/resources/web/tiff.ftl b/server/src/main/resources/web/tiff.ftl
index 1045c6b9b..6a04fb4b1 100644
--- a/server/src/main/resources/web/tiff.ftl
+++ b/server/src/main/resources/web/tiff.ftl
@@ -30,7 +30,7 @@
         var reg = new RegExp(str + "$");
         return reg.test(this);
     }
-    var url = '${finalUrl}';
+    var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
     var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
     if (kkagent === 'true' || !url.startsWith(baseUrl)) {

From 0094514fa7d0c474e8e759993395e58dcf1978d3 Mon Sep 17 00:00:00 2001
From: wylovely <2016688030@qq.com>
Date: Tue, 22 Sep 2026 09:13:45 +0800
Subject: [PATCH 13/18] fix(#790): escape file URL in xmind.ftl with ?js_string
 to prevent SyntaxError on apostrophe

---
 server/src/main/resources/web/xmind.ftl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/main/resources/web/xmind.ftl b/server/src/main/resources/web/xmind.ftl
index 9605322aa..acd708d49 100644
--- a/server/src/main/resources/web/xmind.ftl
+++ b/server/src/main/resources/web/xmind.ftl
@@ -20,7 +20,7 @@
 
 <script src="xmind/xmind.js"></script>
 <script type="text/javascript">
-   	var url = '${finalUrl}';
+   	var url = '${finalUrl?js_string}';
 	var kkagent = '${kkagent}';
     var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
     if (kkagent === 'true' || !url.startsWith(baseUrl)) {

From 6fa1d912969d55c509378b29ce5c1ba61dec870d Mon Sep 17 00:00:00 2001
From: wylovely <2016688030@qq.com>
Date: Tue, 22 Sep 2026 09:14:19 +0800
Subject: [PATCH 14/18] fix(#790): escape file URL in pdf.ftl with ?js_string
 to prevent SyntaxError on apostrophe

---
 server/src/main/resources/web/pdf.ftl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/main/resources/web/pdf.ftl b/server/src/main/resources/web/pdf.ftl
index 462d4c397..d8447ed0e 100644
--- a/server/src/main/resources/web/pdf.ftl
+++ b/server/src/main/resources/web/pdf.ftl
@@ -46,7 +46,7 @@
 </#if>
 
 <script type="text/javascript">
-    var url = '${finalUrl}';
+    var url = '${finalUrl?js_string}';
     var kkagent = '${kkagent}';
     var baseUrl = '${baseUrl}'.endsWith('/') ? '${baseUrl}' : '${baseUrl}' + '/';
     if (kkagent === 'true' || !url.startsWith(baseUrl)) {

From 016a040461cb382ee50dceb7b4f01b549fab82d2 Mon Sep 17 00:00:00 2001
From: wylovely <2016688030@qq.com>
Date: Tue, 22 Sep 2026 09:17:43 +0800
Subject: [PATCH 15/18] test(#790): add regression test asserting file URL is
 JS-escaped in preview template

---
 .../java/cn/keking/PdfViewerCompatibilityTests.java   | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/server/src/test/java/cn/keking/PdfViewerCompatibilityTests.java b/server/src/test/java/cn/keking/PdfViewerCompatibilityTests.java
index 762170564..f18913123 100644
--- a/server/src/test/java/cn/keking/PdfViewerCompatibilityTests.java
+++ b/server/src/test/java/cn/keking/PdfViewerCompatibilityTests.java
@@ -75,6 +75,17 @@ void shouldPreferPdfForOfficePreviewByDefault() throws IOException {
         assertTrue(properties.contains("office.preview.type = ${KK_OFFICE_PREVIEW_TYPE:pdf}"));
     }
 
+    @Test
+    void shouldEscapeFileUrlWithJsStringInPreviewTemplates() throws IOException {
+        // Regression test for #790: a single quote in the source file URL (e.g. a path
+        // segment like "Int'l") was interpolated raw into the inline `var url = '...'`
+        // assignment, terminating the JS string early and throwing Uncaught SyntaxError.
+        // FreeMarker's ?js_string built-in escapes it for the JS string literal context.
+        String pdfTemplate = readResource("/web/pdf.ftl");
+        assertTrue(pdfTemplate.contains("var url = '${finalUrl?js_string}';"),
+                () -> "pdf.ftl must JS-escape the file URL to avoid SyntaxError on apostrophe (see #790)");
+    }
+
     private String readResource(String resourcePath) throws IOException {
         try (InputStream inputStream = getClass().getResourceAsStream(resourcePath)) {
             assertNotNull(inputStream);

From ae7cdf3963c2c12201c93861185dc0ba76c7bd50 Mon Sep 17 00:00:00 2001
From: wylovely <2016688030@qq.com>
Date: Thu, 24 Sep 2026 15:41:22 +0800
Subject: [PATCH 16/18] test(#790): assert JS-escaping of file URL across all
 14 preview templates

---
 .../cn/keking/PdfViewerCompatibilityTests.java   | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/server/src/test/java/cn/keking/PdfViewerCompatibilityTests.java b/server/src/test/java/cn/keking/PdfViewerCompatibilityTests.java
index f18913123..c0570deaa 100644
--- a/server/src/test/java/cn/keking/PdfViewerCompatibilityTests.java
+++ b/server/src/test/java/cn/keking/PdfViewerCompatibilityTests.java
@@ -76,14 +76,22 @@ void shouldPreferPdfForOfficePreviewByDefault() throws IOException {
     }
 
     @Test
-    void shouldEscapeFileUrlWithJsStringInPreviewTemplates() throws IOException {
+    void shouldEscapeFileUrlWithJsStringInAllPreviewTemplates() throws IOException {
         // Regression test for #790: a single quote in the source file URL (e.g. a path
         // segment like "Int'l") was interpolated raw into the inline `var url = '...'`
         // assignment, terminating the JS string early and throwing Uncaught SyntaxError.
         // FreeMarker's ?js_string built-in escapes it for the JS string literal context.
-        String pdfTemplate = readResource("/web/pdf.ftl");
-        assertTrue(pdfTemplate.contains("var url = '${finalUrl?js_string}';"),
-                () -> "pdf.ftl must JS-escape the file URL to avoid SyntaxError on apostrophe (see #790)");
+        // Every preview template that injects the file URL into a JS string literal must
+        // use ?js_string, otherwise a URL containing an apostrophe breaks the page.
+        String[] previewTemplates = {
+                "bpmn", "csv", "dcm", "drawio", "eml", "epub", "msg", "ofd",
+                "officeweb", "online3D", "pdf", "svg", "tiff", "xmind"
+        };
+        for (String name : previewTemplates) {
+            String template = readResource("/web/" + name + ".ftl");
+            assertTrue(template.contains("var url = '${finalUrl?js_string}';"),
+                    () -> name + ".ftl must JS-escape the file URL to avoid SyntaxError on apostrophe (see #790)");
+        }
     }
 
     private String readResource(String resourcePath) throws IOException {

From 7ef274d3761bb2460c78bfe28318cfb215b0f488 Mon Sep 17 00:00:00 2001
From: kl <chenkailing@xd.com>
Date: Thu, 8 Oct 2026 13:04:51 +0800
Subject: [PATCH 17/18] fix: preserve spreadsheet URLs for JavaScript escaping

---
 .../service/impl/OfficeFilePreviewImpl.java   |  4 +-
 .../cn/keking/PreviewUrlEscapingTests.java    | 76 +++++++++++++++++++
 2 files changed, 78 insertions(+), 2 deletions(-)
 create mode 100644 server/src/test/java/cn/keking/PreviewUrlEscapingTests.java

diff --git a/server/src/main/java/cn/keking/service/impl/OfficeFilePreviewImpl.java b/server/src/main/java/cn/keking/service/impl/OfficeFilePreviewImpl.java
index 00051a444..be99cd8eb 100644
--- a/server/src/main/java/cn/keking/service/impl/OfficeFilePreviewImpl.java
+++ b/server/src/main/java/cn/keking/service/impl/OfficeFilePreviewImpl.java
@@ -75,11 +75,11 @@ public String filePreviewHandle(String url, Model model, FileAttribute fileAttri
         if (!officePreviewType.equalsIgnoreCase("html")) {
             if (ConfigConstants.getOfficeTypeWeb().equalsIgnoreCase("web")) {
                 if (suffix.equalsIgnoreCase("xlsx")) {
-                    model.addAttribute("pdfUrl", KkFileUtils.htmlEscape(url)); //特殊符号处理
+                    model.addAttribute("pdfUrl", url); //模板使用 ?js_string 按 JavaScript 字符串上下文转义
                     return XLSX_FILE_PREVIEW_PAGE;
                 }
                 if (suffix.equalsIgnoreCase("csv")) {
-                    model.addAttribute("csvUrl", KkFileUtils.htmlEscape(url));
+                    model.addAttribute("csvUrl", url);
                     return CSV_FILE_PREVIEW_PAGE;
                 }
             }
diff --git a/server/src/test/java/cn/keking/PreviewUrlEscapingTests.java b/server/src/test/java/cn/keking/PreviewUrlEscapingTests.java
new file mode 100644
index 000000000..23c401764
--- /dev/null
+++ b/server/src/test/java/cn/keking/PreviewUrlEscapingTests.java
@@ -0,0 +1,76 @@
+package cn.keking;
+
+import cn.keking.config.ConfigConstants;
+import cn.keking.model.FileAttribute;
+import cn.keking.service.impl.OfficeFilePreviewImpl;
+import cn.keking.service.impl.PdfFilePreviewImpl;
+import freemarker.template.Configuration;
+import freemarker.template.Template;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.springframework.ui.ExtendedModelMap;
+
+import java.io.StringWriter;
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class PreviewUrlEscapingTests {
+
+    @ParameterizedTest
+    @ValueSource(strings = {"pdf", "csv", "xlsx"})
+    void shouldPreserveSourceUrlThroughPreviewModelAndTemplate(String suffix) throws Exception {
+        String sourceUrl = "https://files.example/Int'l/report%20one." + suffix + "?token=a&mode=b";
+        String previousOfficeTypeWeb = ConfigConstants.getOfficeTypeWeb();
+        ConfigConstants.setOfficeTypeWebValue("web");
+        try {
+            FileAttribute file = new FileAttribute();
+            file.setName("report." + suffix);
+            file.setSuffix(suffix);
+            file.setOfficePreviewType("pdf");
+            file.setCacheName("url-escaping-test." + suffix);
+
+            ExtendedModelMap model = new ExtendedModelMap();
+            model.addAttribute("file", file);
+            model.addAttribute("baseUrl", "https://preview.example/");
+            model.addAttribute("kkagent", "false");
+            model.addAttribute("page", "0");
+            model.addAttribute("switchDisabled", "true");
+            model.addAttribute("watermarkTxt", "");
+            model.addAttribute("xlsxshowtoolbar", false);
+            for (String name : new String[]{"watermarkXSpace", "watermarkYSpace", "watermarkAlpha",
+                    "watermarkWidth", "watermarkHeight", "watermarkAngle"}) {
+                model.addAttribute(name, "0");
+            }
+            for (String name : new String[]{"watermarkFont", "watermarkFontsize", "watermarkColor",
+                    "highlightall", "pdfPresentationModeDisable", "pdfOpenFileDisable", "pdfPrintDisable",
+                    "pdfDownloadDisable", "pdfBookmarkDisable", "pdfDisableEditing", "pdfSidebarOpen", "kkkey"}) {
+                model.addAttribute(name, "");
+            }
+
+            OfficeFilePreviewImpl office = new OfficeFilePreviewImpl(null, null, null, null);
+            String view = suffix.equals("pdf")
+                    ? new PdfFilePreviewImpl(null, null, office, null).filePreviewHandle(sourceUrl, model, file)
+                    : office.filePreviewHandle(sourceUrl, model, file);
+            assertEquals(Map.of("pdf", "pdf", "csv", "csv", "xlsx", "officeweb").get(suffix), view);
+            assertEquals(sourceUrl, model.get(suffix.equals("csv") ? "csvUrl" : "pdfUrl"));
+
+            Configuration configuration = new Configuration(Configuration.VERSION_2_3_32);
+            configuration.setClassForTemplateLoading(getClass(), "/web");
+            configuration.setDefaultEncoding("UTF-8");
+            configuration.setClassicCompatible(true);
+            Template template = configuration.getTemplate(view + ".ftl");
+            StringWriter output = new StringWriter();
+            template.process(model, output);
+            String html = output.toString();
+
+            assertTrue(html.contains("var url = 'https://files.example/Int\\'l/report%20one."
+                    + suffix + "?token=a&mode=b';"), html);
+            assertFalse(html.contains("&#39;"), html);
+        } finally {
+            ConfigConstants.setOfficeTypeWebValue(previousOfficeTypeWeb);
+        }
+    }
+}

From 1acd4e4ecd9bcef6caff8e655420529468073c82 Mon Sep 17 00:00:00 2001
From: kl <chenkailing@xd.com>
Date: Thu, 8 Oct 2026 13:14:52 +0800
Subject: [PATCH 18/18] fix: exclude legacy schemas from Office preview
 dependencies

---
 server/pom.xml                                | 16 +++++
 .../utils/OfficeSchemaCompatibilityTests.java | 64 +++++++++++++++++++
 2 files changed, 80 insertions(+)
 create mode 100644 server/src/test/java/cn/keking/utils/OfficeSchemaCompatibilityTests.java

diff --git a/server/pom.xml b/server/pom.xml
index 0baafae82..b1679048d 100644
--- a/server/pom.xml
+++ b/server/pom.xml
@@ -91,17 +91,33 @@
                     <artifactId>poi</artifactId>
                     <groupId>org.apache.poi</groupId>
                 </exclusion>
+                <exclusion>
+                    <groupId>org.apache.poi</groupId>
+                    <artifactId>ooxml-schemas</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
         <dependency>
             <groupId>fr.opensagres.xdocreport</groupId>
             <artifactId>org.apache.poi.xwpf.converter.xhtml</artifactId>
             <version>${xdocreport.version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.apache.poi</groupId>
+                    <artifactId>ooxml-schemas</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>fr.opensagres.xdocreport</groupId>
             <artifactId>fr.opensagres.xdocreport.document</artifactId>
             <version>${xdocreport.version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.apache.poi</groupId>
+                    <artifactId>ooxml-schemas</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>com.aspose</groupId>
diff --git a/server/src/test/java/cn/keking/utils/OfficeSchemaCompatibilityTests.java b/server/src/test/java/cn/keking/utils/OfficeSchemaCompatibilityTests.java
new file mode 100644
index 000000000..ed48a9df3
--- /dev/null
+++ b/server/src/test/java/cn/keking/utils/OfficeSchemaCompatibilityTests.java
@@ -0,0 +1,64 @@
+package cn.keking.utils;
+
+import org.apache.poi.extractor.ExtractorFactory;
+import org.apache.poi.extractor.POITextExtractor;
+import org.apache.poi.xslf.usermodel.XMLSlideShow;
+import org.apache.poi.xwpf.usermodel.XWPFDocument;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.URL;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Collections;
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class OfficeSchemaCompatibilityTests {
+
+    @TempDir
+    Path directory;
+
+    @Test
+    void shouldLoadOneSchemaDefinitionForEachOfficeFormat() throws Exception {
+        for (String schema : new String[]{
+                "org/openxmlformats/schemas/wordprocessingml/x2006/main/DocumentDocument.class",
+                "org/openxmlformats/schemas/presentationml/x2006/main/SldMasterDocument.class"}) {
+            List<URL> definitions = Collections.list(getClass().getClassLoader().getResources(schema));
+            assertEquals(1, definitions.size(), () -> "Conflicting Office schema definitions: " + definitions);
+        }
+    }
+
+    @Test
+    void shouldReadDocxWithCurrentPoiSchemas() throws Exception {
+        Path file = directory.resolve("sample.docx");
+        try (XWPFDocument document = new XWPFDocument(); OutputStream output = Files.newOutputStream(file)) {
+            document.createParagraph().createRun().setText("Schema compatibility");
+            document.write(output);
+        }
+        assertReadable(file);
+    }
+
+    @Test
+    void shouldReadPptxWithCurrentPoiSchemas() throws Exception {
+        Path file = directory.resolve("sample.pptx");
+        try (XMLSlideShow document = new XMLSlideShow(); OutputStream output = Files.newOutputStream(file)) {
+            document.createSlide().createTextBox().setText("Schema compatibility");
+            document.write(output);
+        }
+        assertReadable(file);
+    }
+
+    private void assertReadable(Path file) throws Exception {
+        try (InputStream input = Files.newInputStream(file);
+             POITextExtractor extractor = ExtractorFactory.createExtractor(input)) {
+            assertTrue(extractor.getText().contains("Schema compatibility"));
+        }
+        assertFalse(OfficeUtils.isPwdProtected(file.toString()));
+    }
+}