Skip to content

Conversation

@labkey-bpatel
Copy link

@labkey-bpatel labkey-bpatel commented Apr 9, 2025

Rationale

Secure controller action/API endpoints that might allow unauthorized access to the files on the server by using FileLike instead of File (String, String) pattern.

Related Pull Requests

Changes

  • Convert ValidateReadsetFilesAction and ImportReferenceSequencesAction to use FileLike.
  • Remove unused actions DownloadTempImageAction and ConvertTextToFileAction and its associated form classes.

public static class DownloadTempImageAction extends ExportAction<TempImageAction>
{
@Override
public void export(TempImageAction form, HttpServletResponse response, BindException errors) throws Exception
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@bbimber - Can you please provide a usage scenario for this action. Thanks!

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

are you asking for a way to test it?

Copy link
Collaborator

@bbimber bbimber Apr 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So I believe both DownloadTempImageAction and ConvertTextToFileAction are really old code that I dont see used anywhere. Rather than refactor them, those classes and the associated form classes could be removed. Let me know if you want to do this or have me do it.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well was wondering how that action gets called and how the values for directory and filename gets set.
But sounds good, if they are not being used, then I can remove them as part of this PR.

@labkey-bpatel labkey-bpatel changed the title Convert ValidateReadsetFilesAction, ImportReferenceSequencesAction, DownloadTempImageAction to use FileLike Convert ValidateReadsetFilesAction and ImportReferenceSequencesAction to use FileLike Apr 9, 2025
@labkey-bpatel labkey-bpatel marked this pull request as ready for review April 10, 2025 03:49
for (String fn : form.getFileNames())
{
File f = new File(baseDir, fn);
File f = FileSystemLike.toFile(baseDir.resolveChild(fn));

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No need to convert back to File here. FileLike.exists() should work

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nevermind I see that this gets passed to the job. That's a future story.

@labkey-bpatel labkey-bpatel merged commit 51a9a69 into develop Apr 10, 2025
9 checks passed
@labkey-bpatel labkey-bpatel deleted the fb_use_file_like branch April 10, 2025 17:48
bbimber added a commit that referenced this pull request Aug 21, 2025
Merge discvr-25.3 to discvr-25.7
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants