Improve input params handling (#92)

genepi · Mar 27, 2023 · cd77289 · cd77289
1 parent dec14b9
commit cd77289
Show file tree

Hide file tree

Showing 3 changed files with 47 additions and 24 deletions.
diff --git a/src/main/java/cloudgene/mapred/api/v2/jobs/SubmitJob.java b/src/main/java/cloudgene/mapred/api/v2/jobs/SubmitJob.java
@@ -17,6 +17,7 @@
 import org.apache.commons.fileupload.disk.DiskFileItemFactory;
 import org.apache.commons.fileupload.util.Streams;
 import org.apache.commons.io.FileUtils;
+import org.apache.commons.lang.StringEscapeUtils;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.restlet.ext.fileupload.RestletFileUpload;
@@ -168,23 +169,21 @@ private Map<String, String> parseAndUpdateInputParams(Representation entity, Wdl
 
 				FileItemStream item = iterator.next();
 
-				String name = item.getName();
+				String entryName = StringEscapeUtils.escapeHtml(item.getName());
 
-				if (name != null) {
+				if (entryName != null) {
 
 					File file = null;
 
 					try {
 						// file parameter
 						// write local file
-						String tmpFile = getSettings().getTempFilename(item.getName());
+						String tmpFile = getSettings().getTempFilename(entryName);
 						file = new File(tmpFile);
 
 						FileUtils.copyInputStreamToFile(item.openStream(), file);
 
-						// import into hdfs
-						String entryName = item.getName();
-
+
 						// remove upload indentification!
 						String fieldName = item.getFieldName().replace("-upload", "").replace("input-", "");
 
@@ -260,11 +259,11 @@ private Map<String, String> parseAndUpdateInputParams(Representation entity, Wdl
 
 				} else {
 
-					String key = item.getFieldName();
+					String key = StringEscapeUtils.escapeHtml(item.getFieldName());
 					if (key.startsWith("input-")) {
 						key = key.replace("input-", "");
 					}
-					String value = Streams.asString(item.openStream());
+					String value = StringEscapeUtils.escapeHtml(Streams.asString(item.openStream()));
 					if (!props.containsKey(key)) {
 						// don't override uploaded files
 						props.put(key, value);

diff --git a/src/test/java/cloudgene/mapred/api/v2/jobs/SubmitJobTest.java b/src/test/java/cloudgene/mapred/api/v2/jobs/SubmitJobTest.java
@@ -271,12 +271,11 @@ public void testSubmitWithHiddenInputs() throws IOException, JSONException, Inte
 
 		FormDataSet form = new FormDataSet();
 		form.setMultipart(true);
-		//add visible checkbox
+		// add visible checkbox
 		form.getEntries().add(new FormData("input-checkbox1", "true"));
-		
+
 		// submit job
 		String id = submitJobPublic("print-hidden-inputs", form);
-
 
 		// check feedback
 		waitForJob(id);
@@ -286,18 +285,18 @@ public void testSubmitWithHiddenInputs() throws IOException, JSONException, Inte
 		assertEquals(AbstractJob.STATE_SUCCESS, result.get("state"));
 
 		assertEquals(6, result.getJSONArray("steps").length());
-		assertEquals("text1: my-value\n",
-				result.getJSONArray("steps").getJSONObject(0).getJSONArray("logMessages").getJSONObject(0).get("message"));
-		assertEquals("checkbox1: true\n",
-				result.getJSONArray("steps").getJSONObject(1).getJSONArray("logMessages").getJSONObject(0).get("message"));
-		assertEquals("list1: value1\n",
-				result.getJSONArray("steps").getJSONObject(2).getJSONArray("logMessages").getJSONObject(0).get("message"));
-		assertEquals("text2: my-value\n",
-				result.getJSONArray("steps").getJSONObject(3).getJSONArray("logMessages").getJSONObject(0).get("message"));
-		assertEquals("checkbox2: true\n",
-				result.getJSONArray("steps").getJSONObject(4).getJSONArray("logMessages").getJSONObject(0).get("message"));
-		assertEquals("list2: value1\n",
-				result.getJSONArray("steps").getJSONObject(5).getJSONArray("logMessages").getJSONObject(0).get("message"));
+		assertEquals("text1: my-value\n", result.getJSONArray("steps").getJSONObject(0).getJSONArray("logMessages")
+				.getJSONObject(0).get("message"));
+		assertEquals("checkbox1: true\n", result.getJSONArray("steps").getJSONObject(1).getJSONArray("logMessages")
+				.getJSONObject(0).get("message"));
+		assertEquals("list1: value1\n", result.getJSONArray("steps").getJSONObject(2).getJSONArray("logMessages")
+				.getJSONObject(0).get("message"));
+		assertEquals("text2: my-value\n", result.getJSONArray("steps").getJSONObject(3).getJSONArray("logMessages")
+				.getJSONObject(0).get("message"));
+		assertEquals("checkbox2: true\n", result.getJSONArray("steps").getJSONObject(4).getJSONArray("logMessages")
+				.getJSONObject(0).get("message"));
+		assertEquals("list2: value1\n", result.getJSONArray("steps").getJSONObject(5).getJSONArray("logMessages")
+				.getJSONObject(0).get("message"));
 
 	}
 
@@ -342,4 +341,29 @@ public void testSubmitSftpUpload() throws IOException, JSONException, Interrupte
 
 	// TODO: wrong id
 
+	public void testSubmitHtmlInParams() throws IOException, JSONException, InterruptedException {
+
+		// form data
+
+		String html = "<script>console.log('Hey')<script>";
+
+		FormDataSet form = new FormDataSet();
+		form.setMultipart(true);
+		// add visible checkbox
+		form.getEntries().add(new FormData("text1", "value " + html));
+
+		// submit job
+		String id = submitJobPublic("print-hidden-inputs", form);
+
+		// check feedback
+		waitForJob(id);
+
+		JSONObject result = getJobDetails(id);
+		String message = result.getJSONArray("steps").getJSONObject(0).getJSONArray("logMessages").getJSONObject(0)
+				.get("message").toString();
+		System.out.println(message);
+		assertFalse(message.contains(html));
+
+	}
+
 }
diff --git a/test-data/print-hidden-inputs.yaml b/test-data/print-hidden-inputs.yaml
@@ -5,7 +5,7 @@ workflow:
 
   steps:
     - name: text1
-      cmd: "/bin/echo text1: ${text1}"
+      cmd: "/bin/echo \"text1: ${text1}\""
       bash: true
       stdout: true
     - name: checkbox1