-
Notifications
You must be signed in to change notification settings - Fork 25
3427 relax import list limit #3739
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
0dadd45
b23ec37
549431a
df5eccd
04012cd
bbc6a18
61b64a7
db85886
a284c73
d987ac3
6bd356c
af6cd87
32ce1ed
967a64d
3981036
cec05fe
409e6ca
e1cac8c
4bea811
54b9983
1b2276f
2be9712
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -82,6 +82,7 @@ | |
| def create | ||
| return reload_form unless params_valid? | ||
|
|
||
| warn_about_listed_previous_imports | ||
| assure_user_has_inat_import_api_key | ||
| init_ivars | ||
| request_inat_user_authorization | ||
|
|
@@ -92,11 +93,22 @@ | |
| private | ||
|
|
||
| def reload_form | ||
| @inat_ids = params[:inat_ids] | ||
| # clean trailing commas and whitespace | ||
| @inat_ids = params[:inat_ids].sub(/[,\s]+\z/, "") | ||
| @inat_username = params[:inat_username] | ||
| render(:new) | ||
| end | ||
|
|
||
| # Were any listed iNat IDs previously imported? | ||
| def warn_about_listed_previous_imports | ||
| return if importing_all? || !listing_ids? | ||
|
|
||
| previous_imports = Observation.where(inat_id: inat_id_list) | ||
| return if previous_imports.none? | ||
|
|
||
| flash_warning(:inat_previous_import.t(count: previous_imports.count)) | ||
| end | ||
|
|
||
| def assure_user_has_inat_import_api_key | ||
| key = APIKey.find_by(user: @user, notes: MO_API_KEY_NOTES) | ||
| key = APIKey.create(user: @user, notes: MO_API_KEY_NOTES) if key.nil? | ||
|
|
@@ -111,8 +123,8 @@ | |
| importables: importables_count, | ||
| imported_count: 0, | ||
| avg_import_time: @inat_import.initial_avg_import_seconds, | ||
| inat_ids: params[:inat_ids], | ||
| inat_username: params[:inat_username].strip, | ||
| inat_ids: clean_inat_ids, | ||
| response_errors: "", | ||
| token: "", | ||
| log: [], | ||
|
|
@@ -131,6 +143,22 @@ | |
| params[:inat_ids].split(",").length | ||
| end | ||
|
|
||
| def clean_inat_ids | ||
| # clean trailing commas and whitespace | ||
| inat_ids = params[:inat_ids]&.sub(/[,\s]+\z/, "") | ||
Check failureCode scanning / CodeQL Polynomial regular expression used on uncontrolled data High
This
regular expression Error loading related location Loading user-provided value Error loading related location Loading This regular expression Error loading related location Loading user-provided value Error loading related location Loading
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I think this is low enough of a risk that it is not a blocker. However, I got this from CC: ⏺ Summary Confirmed: Line 148 (and more critically line 97) use uncontrolled user input in regex operations, triggering a security warning. Actual risk: Low
Recommended fix: Extract sanitization to a helper method that validates before using the regex: Then use sanitize_inat_ids(params[:inat_ids]) in both reload_form (line 97) and clean_inat_ids (line 148). This satisfies the security scanner by ensuring validation happens at point-of-use, eliminates code duplication, and follows the principle of defense-in-depth.
Member
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @mo-nathan. 1. Thanks for the review. |
||
| previous_imports = Observation.where(inat_id: inat_id_list) | ||
| return inat_ids if previous_imports.none? | ||
|
|
||
| # remove previously imported ids | ||
| # just in case the iNat user deleted the Mushroom_Observer_URL field | ||
| # NOTE: Also useful in manual testing when writes of iNat obss are | ||
| # commented out temporarily. jdc 2026-01-15 | ||
| previous_ids = previous_imports.pluck(:inat_id).map(&:to_s) | ||
| remaining_ids = | ||
| inat_ids.split(",").map(&:strip).reject { |id| previous_ids.include?(id) } | ||
| remaining_ids.join(",") | ||
| end | ||
|
|
||
| def request_inat_user_authorization | ||
| redirect_to(INAT_AUTHORIZATION_URL, allow_other_host: true) | ||
| end | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| class ChangeInatIdsToText < ActiveRecord::Migration[7.2] | ||
| def up | ||
| change_column(:inat_imports, :inat_ids, :text) | ||
| end | ||
|
|
||
| def down | ||
| change_column(:inat_imports, :inat_ids, :string) | ||
| end | ||
| end |
Uh oh!
There was an error while loading. Please reload this page.