GEM: EntityViewのセクションに高さを設定可能にする 対応

[xlei-duoce]

対応内容

closes #1864

• EntityViewのDefaultSection、MassReferenceSection、ReferenceSection、ScriptingSection、SearchConditionSection、TemplateSection、VersionSectionの高さを設定可能にしました。
• topviewのInformationParts、ScriptParts、SeparatorParts、TemplateParts、CalendarPartsとTreeViewPartsの高さを設定可能にしました。

動作確認・スクリーンショット（任意）

レビュー観点・補足情報（任意）

[Copilot]

Pull request overview

このPRは、EntityViewのセクションおよびトップビューパーツに最大高さ(maxHeight)設定機能を追加し、コンテンツが指定された高さを超える場合にスクロールバーを表示できるようにします。これにより、ユーザーは画面レイアウトをより細かく制御でき、長いコンテンツを持つセクションでもページ全体のレイアウトを維持できます。

主な変更点：

• SectionクラスとTopViewPartsクラスにmaxHeightプロパティを追加
• 各セクションJSPファイルでスタイル属性を適用
• 管理画面UIに最大高さ設定フィールドを追加

Reviewed changes

Copilot reviewed 45 out of 45 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
iplass-gem/src/main/java/org/iplass/mtp/view/generic/element/section/Section.java	セクション基底クラスにsectionHeightプロパティとgetter/setterを追加
iplass-gem/src/main/java/org/iplass/mtp/view/top/parts/TopViewParts.java	トップビューパーツ基底クラスにmaxHeightプロパティとgetter/setterを追加
iplass-gem/src/main/java/org/iplass/gem/command/ViewUtil.java	高さスタイル属性を生成するユーティリティメソッドbuildHeightStyleAttrを追加
iplass-gem/src/main/java/org/iplass/mtp/impl/view/generic/element/section/MetaSection.java	メタデータクラスにsectionHeightフィールドとシリアライゼーションロジックを追加
iplass-gem/src/main/java/org/iplass/mtp/impl/view/top/parts/MetaTopViewParts.java	メタデータクラスにmaxHeightフィールドとfillFrom/fillToメソッドを追加
iplass-web/src/main/java/org/iplass/mtp/impl/web/template/MetaGroovyTemplate.java	WebGroovyTemplateBindingコンストラクタにmaxHeightパラメータを追加し、div wrapperを生成
iplass-gem/src/main/resources/META-INF/resources/jsp/gem/generic/element/section/*.jsp	各セクションJSPでViewUtil.buildHeightStyleAttrを使用してスタイル属性を適用
iplass-gem/src/main/resources/META-INF/resources/jsp/gem/auth/*.jsp	認証関連ページに最大高さスタイルを適用
iplass-admin/src/main/java/org/iplass/adminconsole/client/metadata/ui/top/item/*.java	管理画面の各パーツアイテムダイアログに最大高さ入力フィールドを追加
iplass-admin/src/main/resources/org/iplass/adminconsole/public/locale/*.js	日本語および英語のロケールファイルに新しいラベルと説明を追加
iplass-gem/src/main/sass/flat/module/generic/detail/_detail.scss	セクションのスクロール対応用にSCSSスタイルを追加
iplass-gem/src/main/java/org/iplass/mtp/view/generic/element/section/SearchResultSection.java	既存のdispHeightフィールドを非推奨に設定

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 45 out of 45 changed files in this pull request and generated 10 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 40 out of 40 changed files in this pull request and generated 9 comments.

Comments suppressed due to low confidence (1)

iplass-gem/src/main/java/org/iplass/mtp/impl/view/top/parts/MetaScriptParts.java:199

• The loadParts and loadWidgets methods contain duplicate code. Both methods have identical logic for wrapping content in a div with optional max-height styling. Consider extracting this common logic into a private helper method to reduce code duplication and improve maintainability.

		public void loadParts(HttpServletRequest req, HttpServletResponse res,
				ServletContext application, PageContext page)
				throws IOException, ServletException {
			try {
				Integer mh = meta.getMaxHeight();
				if (mh != null) {
					page.getOut()
							.write("<div style=\"max-height:" + mh.intValue() + "px; overflow:auto;\">\n");
				} else {
					// maxHeight 未設定の場合、height 指定なし
					page.getOut()
							.write("<div>\n");
				}

				template.doTemplate(new MetaGroovyTemplate.WebGroovyTemplateBinding(
						WebUtil.getRequestContext(), req, res, application, page));

				page.getOut()
						.write("</div>\n");
			} catch (IOException e) {
				throw new RuntimeException(e);
			}
		}

		@Override
		public void loadWidgets(HttpServletRequest req,
				HttpServletResponse res, ServletContext application,
				PageContext page) throws IOException, ServletException {
			try {
				Integer mh = meta.getMaxHeight();
				if (mh != null) {
					page.getOut()
							.write("<div style=\"max-height:" + mh.intValue() + "px; overflow:auto;\">\n");
				} else {
					// maxHeight 未設定の場合、height 指定なし
					page.getOut()
							.write("<div>\n");
				}

				template.doTemplate(new MetaGroovyTemplate.WebGroovyTemplateBinding(
						WebUtil.getRequestContext(), req, res, application, page));

				page.getOut()
						.write("</div>\n");
			} catch (IOException e) {
				throw new RuntimeException(e);
			}
		}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 40 out of 40 changed files in this pull request and generated 20 comments.

Comments suppressed due to low confidence (1)

iplass-gem/src/main/resources/META-INF/resources/jsp/gem/calendar/calendarView.jsp:139

• Potential XSS vulnerability: The styleAttr parameter is output with escapeXml="false", which could allow injection of malicious HTML/JavaScript. Since styleAttr comes from ViewUtil.buildHeightStyleAttr() which already constructs the full style attribute string, it should be safe. However, consider either: (1) validating/sanitizing the value before output, or (2) if the source is trusted internal code only, add a comment explaining why it's safe to disable escaping here.

<div id ="<%=calendarName%>" class="flat-block-top" <c:out value="<%=styleAttr%>" escapeXml="false"/>></div>

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 40 out of 40 changed files in this pull request and generated 10 comments.

Comments suppressed due to low confidence (1)

iplass-gem/src/main/resources/META-INF/resources/jsp/gem/calendar/calendarView.jsp:139

• [must] XSS vulnerability: Using escapeXml="false" on user-controlled data is unsafe.

The styleAttr variable, which comes from request parameters and is constructed from user-provided values, is output with escapeXml="false". While the current implementation uses ViewUtil.buildHeightStyleAttr() which expects an Integer, this disables all HTML escaping protections.

Recommendation:
Either:

1. Remove escapeXml="false" and ensure buildHeightStyleAttr() returns properly escaped content, or
2. Add explicit validation/sanitization in buildHeightStyleAttr() and document why unescaped output is safe

<div id ="<%=calendarName%>" class="flat-block-top" <c:out value="<%=styleAttr%>" escapeXml="false"/>></div>

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 43 out of 43 changed files in this pull request and generated 5 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.