From 2114cda07514584d56d6d50be1aab552979d5749 Mon Sep 17 00:00:00 2001 From: Lum Date: Thu, 14 May 2026 12:07:48 -0700 Subject: [PATCH 1/2] Don't allow datasets to be created from regex capture groups. --- .../pipeline/FileAnalysisDatasetTask.java | 32 +++++++++++++++++-- 1 file changed, 29 insertions(+), 3 deletions(-) diff --git a/study/src/org/labkey/study/pipeline/FileAnalysisDatasetTask.java b/study/src/org/labkey/study/pipeline/FileAnalysisDatasetTask.java index 03a6ada2717..b731fa619b6 100644 --- a/study/src/org/labkey/study/pipeline/FileAnalysisDatasetTask.java +++ b/study/src/org/labkey/study/pipeline/FileAnalysisDatasetTask.java @@ -96,17 +96,43 @@ public RecordedActionSet run() throws PipelineJobException // guaranteed to only have a single file assert jobSupport.getInputFiles().size() == 1; + StudyImpl study = getStudy(); for (FileLike file : jobSupport.getInputFiles()) { if (params.containsKey(DATASET_ID_KEY)) - inputDataMap.put(file, new Pair<>(DATASET_ID_KEY, params.get(DATASET_ID_KEY))); + { + int datasetId = Integer.parseInt(params.get(DATASET_ID_KEY)); + if (StudyManager.getInstance().getDatasetDefinition(study, datasetId) != null) + { + _ctx.getLogger().info("Dataset matching the 'id' capture group was resolved : {}", datasetId); + inputDataMap.put(file, new Pair<>(DATASET_ID_KEY, params.get(DATASET_ID_KEY))); + } + else + { + // don't create new datasets via a capture group id + _ctx.getLogger().error("Dataset matching the 'id' capture group was not resolved : {}", datasetId); + return new RecordedActionSet(); + } + } else if (params.containsKey(DATASET_NAME_KEY)) - inputDataMap.put(file, new Pair<>(DATASET_NAME_KEY, params.get(DATASET_NAME_KEY))); + { + String datasetName = params.get(DATASET_NAME_KEY); + if (StudyManager.getInstance().getDatasetDefinitionByName(study, datasetName) != null) + { + _ctx.getLogger().info("Dataset matching the 'name' capture group was resolved : {}", datasetName); + inputDataMap.put(file, new Pair<>(DATASET_NAME_KEY, datasetName)); + } + else + { + // don't create new datasets via a capture group name + _ctx.getLogger().error("Dataset matching the 'name' capture group was not resolved : {}", datasetName); + return new RecordedActionSet(); + } + } else if (params.containsKey(DataTransformService.ORIGINAL_SOURCE_PATH)) inputDataMap.put(file, new Pair<>(DataTransformService.ORIGINAL_SOURCE_PATH, params.get(DataTransformService.ORIGINAL_SOURCE_PATH))); } List readerErrors = new ArrayList<>(); - StudyImpl study = getStudy(); DatasetInferSchemaReader reader = new DatasetInferSchemaReader(getDatasetsDirectory(), getStudy(), _ctx, inputDataMap); reader.validate(readerErrors); From 8c51c63cdef57ab4a48dfbf19cd47ec9650d5649 Mon Sep 17 00:00:00 2001 From: Lum Date: Thu, 14 May 2026 12:33:12 -0700 Subject: [PATCH 2/2] Avoid NFE. --- .../src/org/labkey/study/pipeline/FileAnalysisDatasetTask.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/study/src/org/labkey/study/pipeline/FileAnalysisDatasetTask.java b/study/src/org/labkey/study/pipeline/FileAnalysisDatasetTask.java index b731fa619b6..b7fcb83aaf6 100644 --- a/study/src/org/labkey/study/pipeline/FileAnalysisDatasetTask.java +++ b/study/src/org/labkey/study/pipeline/FileAnalysisDatasetTask.java @@ -15,6 +15,7 @@ */ package org.labkey.study.pipeline; +import org.apache.commons.lang3.math.NumberUtils; import org.jetbrains.annotations.NotNull; import org.labkey.api.action.BaseViewAction; import org.labkey.api.action.NullSafeBindException; @@ -101,7 +102,7 @@ public RecordedActionSet run() throws PipelineJobException { if (params.containsKey(DATASET_ID_KEY)) { - int datasetId = Integer.parseInt(params.get(DATASET_ID_KEY)); + int datasetId = NumberUtils.toInt(params.get(DATASET_ID_KEY)); if (StudyManager.getInstance().getDatasetDefinition(study, datasetId) != null) { _ctx.getLogger().info("Dataset matching the 'id' capture group was resolved : {}", datasetId);