fix: Rx previous instructions modal shows nothing ("nada") when clicking *

[Copilot]

• Review the newly requested PR thread and identify any still-actionable feedback
• Inspect the affected Rx files and compare them to the requested review-thread changes
• Implement the smallest safe fix needed for any still-valid review feedback
• Run targeted validation for the touched Rx files and any relevant CI/log checks
• Run final automated review/security validation on the resulting change
• Reply on the PR thread with the addressing commit hash and validation summary

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[sourcery-ai]

Sorry @yingbull, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[penify-dev]

Failed to generate code suggestions for PR

[Copilot]

Pull request overview

Fixes the Rx “previous instructions” (*) modal failing to open by preventing server-side 500s and ensuring client-side injected scripts don’t abort subsequent execution.

Changes:

• Hardened DrugDaoImpl.findByParameter by binding the value as a named parameter and allowlisting column names to avoid apostrophe crashes and SQL injection.
• Updated CarlosAjax.insertContent to isolate injected script execution so one failing script doesn’t prevent later scripts from running.
• Added null-guards in RxWriteScript2Action.listPreviousInstructions and displayMedHistory.jsp to avoid NPE-driven blank/failed UI.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/main/webapp/share/javascript/carlos-ajax.js	Wrap injected script execution per-script to avoid cascade aborts.
src/main/webapp/oscarRx/displayMedHistory.jsp	Add null guards around session bean / Rx stash item access.
src/main/java/io/github/carlos_emr/carlos/prescript/pageUtil/RxWriteScript2Action.java	Guard missing stash item to avoid NPE when building previous-instructions list.
src/main/java/io/github/carlos_emr/carlos/commn/dao/DrugDaoImpl.java	Parameterize native SQL value and add a column allowlist for safe dynamic column selection.

[yingbull]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved the merge conflicts and pushed true merge commit a7217a19c9. The PR diff is focused back to the 4 Rx-related files after merging latest develop.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• build.shibboleth.net
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --enable-native-access=ALL-UNNAMED -classpath /usr/share/apache-maven-3.9.14/boot/plexus-classworlds-2.9.0.jar -Dclassworlds.conf=/usr/share/apache-maven-3.9.14/bin/m2.conf -Dmaven.home=/usr/share/apache-maven-3.9.14 -Dlibrary.jansi.path=/usr/share/apache-maven-3.9.14/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/carlos/carlos org.codehaus.plexus.classworlds.launcher.Launcher -q --no-transfer-progress -DskipTests compile (dns block)
• jitpack.io
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --enable-native-access=ALL-UNNAMED -classpath /usr/share/apache-maven-3.9.14/boot/plexus-classworlds-2.9.0.jar -Dclassworlds.conf=/usr/share/apache-maven-3.9.14/bin/m2.conf -Dmaven.home=/usr/share/apache-maven-3.9.14 -Dlibrary.jansi.path=/usr/share/apache-maven-3.9.14/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/carlos/carlos org.codehaus.plexus.classworlds.launcher.Launcher -q --no-transfer-progress -DskipTests compile (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[yingbull]

@copilot lgtm?

[Copilot]

@copilot lgtm?

Code-wise, yes: the merge conflict is resolved in a7217a19c9, the PR diff is focused to the 4 intended Rx files, and CodeQL/Socket/submit-maven/code-scanning checks are green. I’d still wait for CI to settle because the copilot job is currently in progress and CodeFactor is reporting failure.

[yingbull]

@copilot are all review comments from all reviewers which are valid review addressed?

[Copilot]

@copilot are all review comments from all reviewers which are valid review addressed?

Yes — from the reviewer feedback on this PR, the valid actionable comments appear addressed in a7217a19c9. Specifically: randomId is now digits-validated and log-sanitized in RxWriteScript2Action, and displayMedHistory.jsp now keeps the table markup inside the null guard so it does not emit a stray </table>. I do not see any other unresolved actionable review comments; the remaining concerns are CI/check status items rather than reviewer feedback.

[yingbull]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

Applied in 05b2cb95. listPreviousInstructions now returns explicit 400/404 errors for invalid or missing randomId state, and I added focused unit coverage for invalid input, missing stash items, and the successful lookup path. git diff --check passed; automated review/CodeQL came back clean; Maven test execution is still blocked in this sandbox by jitpack.io DNS resolution for existing dependencies.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• build.shibboleth.net
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --enable-native-access=ALL-UNNAMED -classpath /usr/share/apache-maven-3.9.14/boot/plexus-classworlds-2.9.0.jar -Dclassworlds.conf=/usr/share/apache-maven-3.9.14/bin/m2.conf -Dmaven.home=/usr/share/apache-maven-3.9.14 -Dlibrary.jansi.path=/usr/share/apache-maven-3.9.14/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/carlos/carlos org.codehaus.plexus.classworlds.launcher.Launcher -Dtest=RxWriteScript2ActionListPreviousInstructionsTest test (dns block)
• jitpack.io
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --enable-native-access=ALL-UNNAMED -classpath /usr/share/apache-maven-3.9.14/boot/plexus-classworlds-2.9.0.jar -Dclassworlds.conf=/usr/share/apache-maven-3.9.14/bin/m2.conf -Dmaven.home=/usr/share/apache-maven-3.9.14 -Dlibrary.jansi.path=/usr/share/apache-maven-3.9.14/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/carlos/carlos org.codehaus.plexus.classworlds.launcher.Launcher -Dtest=RxWriteScript2ActionListPreviousInstructionsTest test (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Ben-Heerema]

I wasn’t able to confidently verify this manually because the prescription UI is hard to navigate. There are multiple * controls with different meanings and the set up is unideal.

Playwright verification did seem to exercise the intended flow successfully: after staging a medication, clicking the* beside the Instructions field sent listPreviousInstructions and opened the med history popup.

I filed a follow-up ticket for the related Rx UI confusion here: #2633 I don’t think that broader UI cleanup needs to block this PR, but it’s worth linking so the remaining verification difficulty is tracked separately. That said, I was unable to verify manually that this was working.