#1994

Committed 12 May 2026 06:57PM UTC coverage: 70.713% (+0.4%) from 70.334%

Build # #1994

Build Type

Pull #751

github

Committed by

kinow

Commit Message

Parse and validate Git URLs parsing URL, instead of using regexes (CodeQL security and performance warnings)

Pull Request Pull Request #751: Bump org.springframework.boot:spring-boot-starter-parent from 3.1.4 to 4.1.0-RC1

Coverage Stats

93 of 148 new or added lines in 29 files covered. (62.84%)

19 existing lines in 3 files now uncovered.

1695 of 2397 relevant lines covered (70.71%)

0.71 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

91.67

/src/main/java/org/commonwl/view/workflow/WorkflowFormValidator.java

/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */

package org.commonwl.view.workflow;

import java.net.URI;
import java.util.List;
import org.apache.commons.lang.StringUtils;
import org.commonwl.view.git.GitDetails;
import org.commonwl.view.validation.GenericGitUrlValidator;
import org.commonwl.view.validation.GitHubUrlValidator;
import org.commonwl.view.validation.GitLabUrlValidator;
import org.commonwl.view.validation.GitUrlValidator;
import org.springframework.stereotype.Component;
import org.springframework.validation.Errors;
import org.springframework.validation.ValidationUtils;

/** Runs validation on the workflow form from the main page */
@Component
public class WorkflowFormValidator {

  /**
   * Validates a WorkflowForm to ensure the URL is not empty and links to a cwl file
   *
   * @param form The given WorkflowForm
   * @param e Any errors from validation
   */
  public GitDetails validateAndParse(WorkflowForm form, Errors e) {

    ValidationUtils.rejectIfEmptyOrWhitespace(e, "url", "url.emptyOrWhitespace");

    if (e.hasErrors()) {
      return null;
    }

    List<GitUrlValidator> handlers =
        List.of(new GitHubUrlValidator(), new GitLabUrlValidator(), new GenericGitUrlValidator());

    for (GitUrlValidator handler : handlers) {
      if (handler.supports(form.getUrl())) {
        GitDetails details = handler.parse(form.getUrl(), form);
        if (details != null) {
          attachPackedId(details, form);
          return details;
        }
      }
    }

    ValidationUtils.rejectIfEmptyOrWhitespace(e, "branch", "branch.emptyOrWhitespace");
    return null;
  }

  /**
   * Attaches a packed workflow ID into the Git details.
   *
   * <p>If no workflow is packed in the request, it searches for the information about the workflow
   * in the URL.
   *
   * @param details Git details
   * @param form Workflow form
   */
  private void attachPackedId(GitDetails details, WorkflowForm form) {
    if (isNotEmptyOrWhitespace(form.getPackedId())) {
      details.setPackedId(form.getPackedId());
      return;
    }

    URI uri = URI.create(form.getUrl());

    String fragment = uri.getFragment();

    if (isNotEmptyOrWhitespace(fragment)) {
      details.setPackedId(fragment);
    }
  }

  /**
   * Checks if a string is empty or whitespace
   *
   * @param str The string to be checked
   * @return Whether the string is empty or whitespace
   */
  private boolean isNotEmptyOrWhitespace(String str) {
    return (str != null && !str.isEmpty() && !StringUtils.isWhitespace(str));
  }
}

1	/*
2	* Licensed to the Apache Software Foundation (ASF) under one
3	* or more contributor license agreements. See the NOTICE file
4	* distributed with this work for additional information
5	* regarding copyright ownership. The ASF licenses this file
6	* to you under the Apache License, Version 2.0 (the
7	* "License"); you may not use this file except in compliance
8	* with the License. You may obtain a copy of the License at
9	*
10	* http://www.apache.org/licenses/LICENSE-2.0
11	*
12	* Unless required by applicable law or agreed to in writing,
13	* software distributed under the License is distributed on an
14	* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15	* KIND, either express or implied. See the License for the
16	* specific language governing permissions and limitations
17	* under the License.
18	*/
19
20	package org.commonwl.view.workflow;
21
22	import java.net.URI;
23	import java.util.List;
24	import org.apache.commons.lang.StringUtils;
25	import org.commonwl.view.git.GitDetails;
26	import org.commonwl.view.validation.GenericGitUrlValidator;
27	import org.commonwl.view.validation.GitHubUrlValidator;
28	import org.commonwl.view.validation.GitLabUrlValidator;
29	import org.commonwl.view.validation.GitUrlValidator;
30	import org.springframework.stereotype.Component;
31	import org.springframework.validation.Errors;
32	import org.springframework.validation.ValidationUtils;
33
34	/** Runs validation on the workflow form from the main page */
35	@Component
36	public class WorkflowFormValidator {	1✔
37
38	/**
39	* Validates a WorkflowForm to ensure the URL is not empty and links to a cwl file
40	*
41	* @param form The given WorkflowForm
42	* @param e Any errors from validation
43	*/
44	public GitDetails validateAndParse(WorkflowForm form, Errors e) {
45
46	ValidationUtils.rejectIfEmptyOrWhitespace(e, "url", "url.emptyOrWhitespace");	1✔
47
48	if (e.hasErrors()) {	1✔
49	return null;	1✔
50	}
51
52	List<GitUrlValidator> handlers =	1✔
53	List.of(new GitHubUrlValidator(), new GitLabUrlValidator(), new GenericGitUrlValidator());	1✔
54
55	for (GitUrlValidator handler : handlers) {	1✔
56	if (handler.supports(form.getUrl())) {	1✔
57	GitDetails details = handler.parse(form.getUrl(), form);	1✔
58	if (details != null) {	1✔
59	attachPackedId(details, form);	1✔
60	return details;	1✔
61	}
62	}
63	}	1✔
64
65	ValidationUtils.rejectIfEmptyOrWhitespace(e, "branch", "branch.emptyOrWhitespace");	1✔
66	return null;	1✔
67	}
68
69	/**
70	* Attaches a packed workflow ID into the Git details.
71	*
72	* <p>If no workflow is packed in the request, it searches for the information about the workflow
73	* in the URL.
74	*
75	* @param details Git details
76	* @param form Workflow form
77	*/
78	private void attachPackedId(GitDetails details, WorkflowForm form) {
79	if (isNotEmptyOrWhitespace(form.getPackedId())) {	1✔
NEW 80	details.setPackedId(form.getPackedId());	×
NEW 81	return;	×
82	}
83
84	URI uri = URI.create(form.getUrl());	1✔
85
86	String fragment = uri.getFragment();	1✔
87
88	if (isNotEmptyOrWhitespace(fragment)) {	1✔
89	details.setPackedId(fragment);	1✔
90	}
91	}	1✔
92
93	/**
94	* Checks if a string is empty or whitespace
95	*
96	* @param str The string to be checked
97	* @return Whether the string is empty or whitespace
98	*/
99	private boolean isNotEmptyOrWhitespace(String str) {
100	return (str != null && !str.isEmpty() && !StringUtils.isWhitespace(str));	1✔
101	}
102	}

common-workflow-language / cwlviewer / #1994

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous