From cd77289d5cdf950d45066215dda047aeaa76587f Mon Sep 17 00:00:00 2001 From: Lukas Forer Date: Mon, 27 Mar 2023 10:33:55 +0200 Subject: [PATCH 01/30] Improve input params handling (#92) --- .../mapred/api/v2/jobs/SubmitJob.java | 15 +++--- .../mapred/api/v2/jobs/SubmitJobTest.java | 54 +++++++++++++------ test-data/print-hidden-inputs.yaml | 2 +- 3 files changed, 47 insertions(+), 24 deletions(-) diff --git a/src/main/java/cloudgene/mapred/api/v2/jobs/SubmitJob.java b/src/main/java/cloudgene/mapred/api/v2/jobs/SubmitJob.java index d3c58a9c..550dc7f3 100644 --- a/src/main/java/cloudgene/mapred/api/v2/jobs/SubmitJob.java +++ b/src/main/java/cloudgene/mapred/api/v2/jobs/SubmitJob.java @@ -17,6 +17,7 @@ import org.apache.commons.fileupload.disk.DiskFileItemFactory; import org.apache.commons.fileupload.util.Streams; import org.apache.commons.io.FileUtils; +import org.apache.commons.lang.StringEscapeUtils; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; import org.restlet.ext.fileupload.RestletFileUpload; @@ -168,23 +169,21 @@ private Map parseAndUpdateInputParams(Representation entity, Wdl FileItemStream item = iterator.next(); - String name = item.getName(); + String entryName = StringEscapeUtils.escapeHtml(item.getName()); - if (name != null) { + if (entryName != null) { File file = null; try { // file parameter // write local file - String tmpFile = getSettings().getTempFilename(item.getName()); + String tmpFile = getSettings().getTempFilename(entryName); file = new File(tmpFile); FileUtils.copyInputStreamToFile(item.openStream(), file); - // import into hdfs - String entryName = item.getName(); - + // remove upload indentification! String fieldName = item.getFieldName().replace("-upload", "").replace("input-", ""); @@ -260,11 +259,11 @@ private Map parseAndUpdateInputParams(Representation entity, Wdl } else { - String key = item.getFieldName(); + String key = StringEscapeUtils.escapeHtml(item.getFieldName()); if (key.startsWith("input-")) { key = key.replace("input-", ""); } - String value = Streams.asString(item.openStream()); + String value = StringEscapeUtils.escapeHtml(Streams.asString(item.openStream())); if (!props.containsKey(key)) { // don't override uploaded files props.put(key, value); diff --git a/src/test/java/cloudgene/mapred/api/v2/jobs/SubmitJobTest.java b/src/test/java/cloudgene/mapred/api/v2/jobs/SubmitJobTest.java index d2f653af..71af703a 100644 --- a/src/test/java/cloudgene/mapred/api/v2/jobs/SubmitJobTest.java +++ b/src/test/java/cloudgene/mapred/api/v2/jobs/SubmitJobTest.java @@ -271,12 +271,11 @@ public void testSubmitWithHiddenInputs() throws IOException, JSONException, Inte FormDataSet form = new FormDataSet(); form.setMultipart(true); - //add visible checkbox + // add visible checkbox form.getEntries().add(new FormData("input-checkbox1", "true")); - + // submit job String id = submitJobPublic("print-hidden-inputs", form); - // check feedback waitForJob(id); @@ -286,18 +285,18 @@ public void testSubmitWithHiddenInputs() throws IOException, JSONException, Inte assertEquals(AbstractJob.STATE_SUCCESS, result.get("state")); assertEquals(6, result.getJSONArray("steps").length()); - assertEquals("text1: my-value\n", - result.getJSONArray("steps").getJSONObject(0).getJSONArray("logMessages").getJSONObject(0).get("message")); - assertEquals("checkbox1: true\n", - result.getJSONArray("steps").getJSONObject(1).getJSONArray("logMessages").getJSONObject(0).get("message")); - assertEquals("list1: value1\n", - result.getJSONArray("steps").getJSONObject(2).getJSONArray("logMessages").getJSONObject(0).get("message")); - assertEquals("text2: my-value\n", - result.getJSONArray("steps").getJSONObject(3).getJSONArray("logMessages").getJSONObject(0).get("message")); - assertEquals("checkbox2: true\n", - result.getJSONArray("steps").getJSONObject(4).getJSONArray("logMessages").getJSONObject(0).get("message")); - assertEquals("list2: value1\n", - result.getJSONArray("steps").getJSONObject(5).getJSONArray("logMessages").getJSONObject(0).get("message")); + assertEquals("text1: my-value\n", result.getJSONArray("steps").getJSONObject(0).getJSONArray("logMessages") + .getJSONObject(0).get("message")); + assertEquals("checkbox1: true\n", result.getJSONArray("steps").getJSONObject(1).getJSONArray("logMessages") + .getJSONObject(0).get("message")); + assertEquals("list1: value1\n", result.getJSONArray("steps").getJSONObject(2).getJSONArray("logMessages") + .getJSONObject(0).get("message")); + assertEquals("text2: my-value\n", result.getJSONArray("steps").getJSONObject(3).getJSONArray("logMessages") + .getJSONObject(0).get("message")); + assertEquals("checkbox2: true\n", result.getJSONArray("steps").getJSONObject(4).getJSONArray("logMessages") + .getJSONObject(0).get("message")); + assertEquals("list2: value1\n", result.getJSONArray("steps").getJSONObject(5).getJSONArray("logMessages") + .getJSONObject(0).get("message")); } @@ -342,4 +341,29 @@ public void testSubmitSftpUpload() throws IOException, JSONException, Interrupte // TODO: wrong id + public void testSubmitHtmlInParams() throws IOException, JSONException, InterruptedException { + + // form data + + String html = " <#if google_analytics??> - + + - + From 4f9ba91932dab6fb8f7db9585eac3c95f91aa0a4 Mon Sep 17 00:00:00 2001 From: Lukas Forer Date: Tue, 3 Oct 2023 09:53:57 +0200 Subject: [PATCH 30/30] Update yamlbeans to 1.17 (#128) --- pom.xml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pom.xml b/pom.xml index f089cebe..9062184d 100644 --- a/pom.xml +++ b/pom.xml @@ -237,9 +237,9 @@ - com.esotericsoftware.yamlbeans - yamlbeans - 1.15 + com.contrastsecurity + yamlbeans + 1.17