Skip to content

Improved validation for XML parsing and paths #7422

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
labkey-jeckels merged 1 commit into from
Feb 16, 2026
+10 −3
Merged

Improved validation for XML parsing and paths #7422

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion api/src/org/labkey/api/reader/ExcelLoader.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@
import org.labkey.api.util.FileUtil;
import org.labkey.api.util.JunitUtil;
import org.labkey.api.util.StringUtilsLabKey;
import org.labkey.api.util.XmlBeansUtil;
import org.labkey.vfs.FileLike;
import org.labkey.vfs.FileSystemLike;
import org.xml.sax.Attributes;
Expand Down Expand Up @@ -540,7 +541,7 @@ private Thread startAsyncParsing() throws IOException, InvalidFormatException
if (sheetMatches(sheetIndex, iter.getSheetName()))
{
InputSource sheetSource = new InputSource(stream);
SAXParserFactory saxFactory = SAXParserFactory.newInstance();
SAXParserFactory saxFactory = XmlBeansUtil.SAX_PARSER_FACTORY;
try
{
SAXParser saxParser = saxFactory.newSAXParser();
Expand Down
2 changes: 1 addition & 1 deletion core/src/org/labkey/core/attachment/AttachmentServiceImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,7 +289,7 @@ public synchronized void addAttachments(AttachmentParent parent, List<Attachment
}

Set<String> filesToSkip = new TreeSet<>();
File fileLocation = parent instanceof AttachmentDirectory ? ((AttachmentDirectory) parent).getFileSystemDirectory() : null;
File fileLocation = parent instanceof AttachmentDirectory dir ? dir.getFileSystemDirectory() : null;

for (AttachmentFile file : files)
{
Expand Down
2 changes: 1 addition & 1 deletion filecontent/src/org/labkey/filecontent/FileSystemAttachmentParent.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,7 +191,7 @@ public void addAttachment(User user, AttachmentFile file) throws IOException
{
Path fileLocation = getFileSystemDirectoryPath();
InputStream is = file.openInputStream();
Path saveFile = fileLocation.resolve(file.getFilename());
Path saveFile = FileUtil.appendName(fileLocation, file.getFilename());
try
{
Files.copy(is, saveFile);
Expand Down
6 changes: 6 additions & 0 deletions pipeline/src/org/labkey/pipeline/api/PipelineStatusManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -694,6 +694,12 @@ public static void completeStatus(User user, Collection<Long> rowIds)
PipelineStatusFileImpl sf = PipelineStatusManager.getStatusFile(rowId);
if (sf != null)
{
Container container = sf.lookupContainer();
if (container == null || !container.hasPermission(user, UpdatePermission.class))
{
throw new UnauthorizedException();
}

LOG.info("Job " + sf.getFilePath() + " was marked as complete by " + user);
sf.setStatus(PipelineJob.TaskStatus.complete.toString());
sf.setInfo(null);
Expand Down