Merge remote-tracking branch 'origin/release25.7-SNAPSHOT' into 25.7_fb_owasp_lists_audit

labkey-bpatel · labkey-bpatel · commit 14fdae7e6dd4 · 2026-07-06T22:28:08.000-06:00
diff --git a/src/org/labkey/test/tests/AbstractKnitrReportTest.java b/src/org/labkey/test/tests/AbstractKnitrReportTest.java
@@ -175,7 +175,7 @@ protected void htmlFormat()
                                             Locator.tag("img").withAttribute("alt", "plot of chunk blood-pressure-scatter")), // new
                                     Locator.tag("pre").containing("## \"1\",249318596,\"2008-05-17\",86,36,129,76,64"),
                                     Locator.tag("pre").withText("## knitr says hello to HTML!"),
-                                    Locator.tag("pre").startsWith("## Error").containing(": non-numeric argument to binary operator"),
+                                    Locator.tag("pre").startsWith("## Error").containing("non-numeric argument to binary operator"),
                                     Locator.tag("p").startsWith("Well, everything seems to be working. Let's ask R what is the value of \u03C0? Of course it is 3.141"),
                                     nonceCheckSuccessLoc // Inline script should run
         };
diff --git a/src/org/labkey/test/tests/AttachmentFieldTest.java b/src/org/labkey/test/tests/AttachmentFieldTest.java
@@ -1,5 +1,6 @@
 package org.labkey.test.tests;
 
+import org.apache.hc.core5.http.HttpStatus;
 import org.assertj.core.api.Assertions;
 import org.jetbrains.annotations.Nullable;
 import org.junit.Assert;
@@ -9,25 +10,36 @@
 import org.labkey.test.BaseWebDriverTest;
 import org.labkey.test.Locator;
 import org.labkey.test.TestFileUtils;
+import org.labkey.test.WebTestHelper;
 import org.labkey.test.categories.Daily;
 import org.labkey.test.components.DomainDesignerPage;
 import org.labkey.test.components.domain.DomainFieldRow;
 import org.labkey.test.components.domain.DomainFormPanel;
+import org.labkey.test.pages.ReactAssayDesignerPage;
 import org.labkey.test.pages.experiment.UpdateSampleTypePage;
 import org.labkey.test.params.FieldDefinition;
 import org.labkey.test.params.experiment.SampleTypeDefinition;
+import org.labkey.test.util.ApiPermissionsHelper;
 import org.labkey.test.util.DataRegionTable;
+import org.labkey.test.util.PasswordUtil;
+import org.labkey.test.util.PermissionsHelper;
 import org.labkey.test.util.PortalHelper;
 import org.labkey.test.util.SampleTypeHelper;
 import org.labkey.test.util.TestDataGenerator;
 
+import org.openqa.selenium.By;
+import org.openqa.selenium.support.ui.ExpectedConditions;
+
 import java.io.File;
+import java.net.URI;
 import java.util.List;
 
 @Category({Daily.class})
 @BaseWebDriverTest.ClassTimeout(minutes = 2)
 public class AttachmentFieldTest extends BaseWebDriverTest
 {
+    private static final String RESTRICTED_PROJECT = "AttachmentFieldTest Restricted Project";
+    private static final String RESTRICTED_USER = "restrictedreader@attachmentfieldtest.test";
     private final File SAMPLE_FILE = new File(TestFileUtils.getSampleData("fileTypes"), "jpg_sample.jpg");
 
     @BeforeClass
@@ -57,6 +69,14 @@ private void doSetup()
         portalHelper.addBodyWebPart("Lists");
     }
 
+    @Override
+    protected void doCleanup(boolean afterTest)
+    {
+        super.doCleanup(afterTest);
+        _containerHelper.deleteProject(RESTRICTED_PROJECT, false);
+        _userHelper.deleteUsers(false, RESTRICTED_USER);
+    }
+
     @Test
     public void testFileFieldInSampleType()
     {
@@ -138,4 +158,63 @@ public void testAttachmentFieldInLists()
         File downloadedFile = doAndWaitForDownload(() -> Locator.tagWithAttributeContaining("img", "title", SAMPLE_FILE.getName()).findElement(getDriver()).click());
         Assert.assertTrue("Downloaded file is empty", downloadedFile.length() > 0);
     }
+
+    // Kanban #1924
+    @Test
+    public void testDownloadFileLinkCrossContainerPermission()
+    {
+        final String assayName = "CrossContainerAssay";
+        final String runFieldName = "runFile";
+
+        log("Create restricted project with Assay folder type to provide a pipeline root for file storage");
+        _containerHelper.createProject(RESTRICTED_PROJECT, "Assay");
+
+        log("Create a General assay with a run-level file link field");
+        goToProjectHome(RESTRICTED_PROJECT);
+        goToManageAssays();
+        ReactAssayDesignerPage assayDesigner = _assayHelper.createAssayDesign("General", assayName);
+        assayDesigner.setEditableRuns(true);
+        assayDesigner.goToRunFields().addField(runFieldName).setType(FieldDefinition.ColumnType.File);
+        assayDesigner.clickFinish();
+
+        log("Import a minimal assay run");
+        clickAndWait(Locator.linkWithText(assayName));
+        clickButton("Import Data");
+        clickButton("Next");
+        setFormElement(Locator.name("name"), "TestRun");
+        setFormElement(Locator.name("TextAreaDataCollector.textArea"),
+                "Specimen ID\tParticipant ID\tVisit ID\n100\t1A2B\t1");
+        clickButton("Save and Finish");
+
+        log("Edit the run to set the file field");
+        clickAndWait(Locator.linkWithText("view runs"));
+        new DataRegionTable("Runs", getDriver()).clickEditRow(0);
+        setFormElement(Locator.name("quf_" + runFieldName), SAMPLE_FILE);
+        clickButton("Submit");
+        waitForElement(DataRegionTable.updateLinkLocator());
+
+        log("Hover over the run file thumbnail to reveal the popup and get the objectURI-based downloadFileLink URL");
+        mouseOver(Locator.xpath("//img[contains(@title, '" + SAMPLE_FILE.getName() + "')]"));
+        longWait().until(ExpectedConditions.visibilityOfElementLocated(By.cssSelector("#helpDiv")));
+        String restrictedDownloadUrl = Locator.xpath("//div[@id='helpDiv']//img[contains(@src, 'downloadFileLink')]")
+                .findElement(getDriver()).getAttribute("src");
+        Assertions.assertThat(restrictedDownloadUrl).as("Expected downloadFileLink URL with objectURI parameter")
+                .contains("downloadFileLink")
+                .contains("objectURI");
+
+        // Build a cross-container URL: keep the same objectURI (run LSID) and propertyId but use the main project's
+        // container.
+        String crossContainerUrl = WebTestHelper.buildURL("core", getProjectName(), "downloadFileLink")
+                + "?" + URI.create(restrictedDownloadUrl).getRawQuery();
+
+        log("Create a reader user with access to the main project only, not to the restricted project");
+        _userHelper.createUser(RESTRICTED_USER);
+        _userHelper.setInitialPassword(RESTRICTED_USER);
+        new ApiPermissionsHelper(this).addMemberToRole(RESTRICTED_USER, "Reader", PermissionsHelper.MemberType.user, getProjectName());
+
+        log("Verify cross-container download is rejected with 403 when user lacks read permission on the object's container");
+        int status = WebTestHelper.getHttpResponse(crossContainerUrl, RESTRICTED_USER, PasswordUtil.getPassword()).getResponseCode();
+        Assert.assertEquals("Expected 403 Forbidden when user lacks read permission on the object's container",
+                HttpStatus.SC_FORBIDDEN, status);
+    }
 }
diff --git a/src/org/labkey/test/tests/SpecimenTest.java b/src/org/labkey/test/tests/SpecimenTest.java
@@ -31,6 +31,7 @@
 import org.labkey.test.components.html.BootstrapMenu;
 import org.labkey.test.pages.ImportDataPage;
 import org.labkey.test.pages.study.specimen.ManageNotificationsPage;
+import org.labkey.test.util.ApiPermissionsHelper;
 import org.labkey.test.util.DataRegionTable;
 import org.labkey.test.util.LogMethod;
 import org.labkey.test.util.LoggedParam;
@@ -132,6 +133,7 @@ protected void setupRequestabilityRules()
     protected void doVerifySteps() throws IOException
     {
         verifyActorDetails();
+        verifySpecimenEventsRedirect();
         createRequest();
         verifyViews();
         verifyAdditionalRequestFields();
@@ -325,6 +327,37 @@ private void verifyActorDetails()
         DataRegion(getDriver()).withName("SpecimenRequest").waitFor();
     }
 
+    // Simulate SpecimenForeignKey redirect behavior
+    @LogMethod (quiet = true)
+    private void verifySpecimenEventsRedirect()
+    {
+        String targetStudyId = getContainerId();
+
+        // Create an empty second folder (doesn't need to be a study) with guest read. We'll attempt to invoke the
+        // redirect action from this folder.
+        String folderName = "Another Study";
+        _containerHelper.createSubfolder(getProjectName(), folderName, "Study");
+        new ApiPermissionsHelper(this).setSiteGroupPermissions("Guests", "Reader");
+
+        // Happy path - admin should redirect
+        String baseUrl = WebTestHelper.getBaseURL() + "/" + getProjectName() + "/" + folderName + "/specimen-specimenEventsRedirect.view?targetStudy=" + targetStudyId + "&id=";
+        String url = baseUrl + "AAA07XK5-01";
+        beginAt(url);
+        assertTextPresent("Vial History", "999320812", "350V0600294A");
+
+        // Guest has access in Another Study but not in the target study (My Study), so should not redirect
+        signOut();
+        beginAt(baseUrl + "abcdefg_123456"); // Bogus ID and user doesn't have read permission
+        assertTextPresent("Unable to resolve the Specimen ID and target Study");
+        beginAt(url); // Valid ID, but user doesn't have read permission to target study, so same error
+        assertTextPresent("Unable to resolve the Specimen ID and target Study");
+
+        // Sign in and back to the main study
+        signIn();
+        goToProjectHome();
+        clickFolder(getFolderName());
+    }
+
     @LogMethod
     private void createRequest()
     {
@@ -1048,7 +1081,7 @@ private void verifyDrawTimestampConflict(String qcControl, String timestamp, Str
     {
         if (StringUtils.isBlank(qcControl))
         {
-            // no conflict, so all three fields shold be valid
+            // no conflict, so all three fields should be valid
             assertTrue(StringUtils.isNotBlank(timestamp));
             assertTrue(StringUtils.isNotBlank(time));
             assertTrue(StringUtils.isNotBlank(date));
diff --git a/src/org/labkey/test/tests/core/security/GetContainerInfoAPITest.java b/src/org/labkey/test/tests/core/security/GetContainerInfoAPITest.java
@@ -0,0 +1,102 @@
+package org.labkey.test.tests.core.security;
+
+import org.apache.hc.core5.http.HttpStatus;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.experimental.categories.Category;
+import org.labkey.test.BaseWebDriverTest;
+import org.labkey.test.TestTimeoutException;
+import org.labkey.test.WebTestHelper;
+import org.labkey.test.categories.Daily;
+import org.labkey.test.util.APIContainerHelper;
+import org.labkey.test.util.ApiPermissionsHelper;
+import org.labkey.test.util.PasswordUtil;
+import org.labkey.test.util.PermissionsHelper;
+
+import java.util.List;
+import java.util.Map;
+
+import static org.junit.Assert.assertEquals;
+
+/**
+ * Tests cross-container permission enforcement in CoreController.GetContainerInfoAction (Kanban #1924).
+ *
+ * The action accepts an optional {@code containerPath} parameter. Prior to the fix, a user who had
+ * ReadPermission on the request container could supply any container path and receive information about
+ * it — even containers they had no access to. The fix adds a check that the user also has ReadPermission
+ * on the resolved container before returning any data.
+ */
+@Category({Daily.class})
+public class GetContainerInfoAPITest extends BaseWebDriverTest
+{
+    private static final String READABLE_PROJECT = "GetContainerInfoAPITest Readable";
+    private static final String RESTRICTED_PROJECT = "GetContainerInfoAPITest Restricted";
+    private static final String READER_USER = "reader@getcontainerinfoapi.test";
+
+    private final ApiPermissionsHelper _permissions = new ApiPermissionsHelper(this);
+
+    public GetContainerInfoAPITest()
+    {
+        ((APIContainerHelper) _containerHelper).setNavigateToCreatedFolders(false);
+    }
+
+    @BeforeClass
+    public static void setupProject()
+    {
+        GetContainerInfoAPITest init = getCurrentTest();
+        init.doSetup();
+    }
+
+    private void doSetup()
+    {
+        _containerHelper.createProject(READABLE_PROJECT, "Collaboration");
+        _containerHelper.createProject(RESTRICTED_PROJECT, "Collaboration");
+
+        _userHelper.createUser(READER_USER);
+        _userHelper.setInitialPassword(READER_USER);
+        _permissions.addMemberToRole(READER_USER, "Reader", PermissionsHelper.MemberType.user, READABLE_PROJECT);
+        // Intentionally not granting the user any role in RESTRICTED_PROJECT
+    }
+
+    @Override
+    protected void doCleanup(boolean afterTest) throws TestTimeoutException
+    {
+        _containerHelper.deleteProject(READABLE_PROJECT, afterTest);
+        _containerHelper.deleteProject(RESTRICTED_PROJECT, afterTest);
+        _userHelper.deleteUsers(false, READER_USER);
+    }
+
+    @Override
+    protected String getProjectName()
+    {
+        return null;
+    }
+
+    @Override
+    public List<String> getAssociatedModules()
+    {
+        return null;
+    }
+
+    // Kanban #1924
+    @Test
+    public void testGetContainerInfoAccessControl()
+    {
+        // Cross-container denial: user makes the request from READABLE_PROJECT (passing @RequiresPermission),
+        // but containerPath resolves to RESTRICTED_PROJECT where the user has no ReadPermission. Expect 403.
+        String restrictedUrl = WebTestHelper.buildURL("core", READABLE_PROJECT, "getContainerInfo",
+                Map.of("containerPath", RESTRICTED_PROJECT, "newFolderType", "Collaboration"));
+        int restrictedStatus = WebTestHelper.getHttpResponse(restrictedUrl, READER_USER, PasswordUtil.getPassword())
+                .getResponseCode();
+        assertEquals("Expected 403 when user lacks ReadPermission on the containerPath container",
+                HttpStatus.SC_FORBIDDEN, restrictedStatus);
+
+        // Same-container success: containerPath resolves to READABLE_PROJECT where the user is a Reader. Expect 200.
+        String readableUrl = WebTestHelper.buildURL("core", READABLE_PROJECT, "getContainerInfo",
+                Map.of("containerPath", READABLE_PROJECT, "newFolderType", "Collaboration"));
+        int readableStatus = WebTestHelper.getHttpResponse(readableUrl, READER_USER, PasswordUtil.getPassword())
+                .getResponseCode();
+        assertEquals("Expected 200 when user has ReadPermission on the containerPath container",
+                HttpStatus.SC_OK, readableStatus);
+    }
+}
diff --git a/src/org/labkey/test/tests/experiment/GetEntitySequenceAPITest.java b/src/org/labkey/test/tests/experiment/GetEntitySequenceAPITest.java
diff --git a/src/org/labkey/test/tests/filecontent/UpdateFilePropsContainerScopeTest.java b/src/org/labkey/test/tests/filecontent/UpdateFilePropsContainerScopeTest.java
