Skip to content

Address reported security issues in the panoramapublic module #655

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vagisha wants to merge 2 commits into
base: release26.3-SNAPSHOT
Choose a base branch
from
+21 −64
Open

Address reported security issues in the panoramapublic module #655

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5a4c48e
Restricted mock NCBI publication search test actions to dev mode
vagisha Jun 29, 2026
aec9577
Removed unused System.out helpers (printStructuralMod, printIsotopicM…
vagisha Jun 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 17 additions & 3 deletions panoramapublic/src/org/labkey/panoramapublic/PanoramaPublicController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@
import org.labkey.api.action.FormHandlerAction;
import org.labkey.api.action.FormViewAction;
import org.labkey.api.action.LabKeyError;
import org.labkey.api.action.MutatingApiAction;
import org.labkey.api.action.ReadOnlyApiAction;
import org.labkey.api.action.ReturnUrlForm;
import org.labkey.api.action.SimpleErrorView;
Expand Down Expand Up @@ -11233,34 +11234,47 @@ public static ActionURL getCatalogImageDownloadUrl(ExperimentAnnotations expAnno

// ======================== Support actions for Selenium tests ========================

// These actions swap the process-wide NCBI publication search service to a mock so that Selenium tests
// run without calling the live NCBI API. They must never be reachable on a production server (non-dev-mode)
private static void requireDevModeForMockNcbiService()
{
if (!AppProps.getInstance().isDevMode())
{
throw new NotFoundException("Mock NCBI publication search service actions are only available on a server running in dev mode.");
}
}

@RequiresSiteAdmin
public static class SetupMockNcbiServiceAction extends ReadOnlyApiAction<Object>
public static class SetupMockNcbiServiceAction extends MutatingApiAction<Object>
{
@Override
public Object execute(Object form, BindException errors)
{
requireDevModeForMockNcbiService();
NcbiPublicationSearchServiceImpl.setInstance(new MockNcbiPublicationSearchService());
return new ApiSimpleResponse("mock", true);
}
}

@RequiresSiteAdmin
public static class RestoreNcbiServiceAction extends ReadOnlyApiAction<Object>
public static class RestoreNcbiServiceAction extends MutatingApiAction<Object>
{
@Override
public Object execute(Object form, BindException errors)
{
requireDevModeForMockNcbiService();
NcbiPublicationSearchServiceImpl.setInstance(new NcbiPublicationSearchServiceImpl());
return new ApiSimpleResponse("restored", true);
}
}

@RequiresSiteAdmin
public static class RegisterMockPublicationAction extends ReadOnlyApiAction<RegisterMockPublicationForm>
public static class RegisterMockPublicationAction extends MutatingApiAction<RegisterMockPublicationForm>
{
@Override
public Object execute(RegisterMockPublicationForm form, BindException errors)
{
requireDevModeForMockNcbiService();
NcbiPublicationSearchService service = NcbiPublicationSearchServiceImpl.getInstance();
if (!(service instanceof MockNcbiPublicationSearchService mock))
{
Expand Down
57 changes: 0 additions & 57 deletions ...amapublic/src/org/labkey/panoramapublic/proteomexchange/ExperimentModificationGetter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -345,8 +345,6 @@ public PxIsotopicMod(String skylineName, long dbModId, UnimodModification uMod,

public static class TestCase extends Assert
{
private static final boolean debug = false;

@Test
public void testBuildIsotopeModFormula()
{
Expand Down Expand Up @@ -701,8 +699,6 @@ public void testStructuralMods() throws IOException
{
PxModification pxMod = getStructuralUnimodMod(mod, uMods);

printStructuralMod(mod, pxMod);

List<UnimodModification> matches = unimodMatches.get(pxMod.getSkylineName());
if (matches.isEmpty())
{
Expand All @@ -727,32 +723,6 @@ else if (matches.size() == 1)
}
}

private void printStructuralMod(Modification mod, PxModification pxMod)
{
if (!debug)
{
return;
}

if (pxMod.hasUnimodId())
{
String term = mod.getTerminus() == null ? "" : (mod.getTerminus().equals("N") ? "N-term" : "C-term");
String modInfo = pxMod.getSkylineName() + ", " + Formula.normalizeFormula(mod.getFormula()) + ", " + mod.getAminoAcid() + ", TERM: " + term;
System.out.print("Skyline: " + modInfo);
System.out.println(" --- " + pxMod.getUnimodId() + ", " + pxMod.getName());
}
if (pxMod.hasPossibleUnimods())
{
String term = mod.getTerminus() == null ? "" : (mod.getTerminus().equals("N") ? "N-term" : "C-term");
String modInfo = pxMod.getSkylineName() + ", " + Formula.normalizeFormula(mod.getFormula()) + ", " + mod.getAminoAcid() + ", TERM: " + term;
System.out.println("Skyline: " + modInfo);
for (UnimodModification umod: pxMod.getPossibleUnimodMatches())
{
System.out.println(" --- List.of(new UnimodModification(" + umod.getId() + ", \"" + umod.getName() + "\", null))");
}
}
}

@Test
public void testIsotopicMods() throws IOException
{
Expand Down Expand Up @@ -899,8 +869,6 @@ public void testIsotopicMods() throws IOException
}
PxModification pxMod = getIsotopicUnimodMod(mod, uMods);

printIsotopicMod(mod, pxMod);

List<UnimodModification> expectedMatches = matches.get(pxMod.getSkylineName());

if (expectedMatches.isEmpty())
Expand All @@ -926,31 +894,6 @@ else if (expectedMatches.size() > 1)
}
}

private void printIsotopicMod(IsotopeModification mod, PxModification pxMod)
{
if (!debug)
{
return;
}
if (pxMod.hasUnimodId())
{
String term = mod.getTerminus() == null ? "" : (mod.getTerminus().equals("N") ? "N-term" : "C-term");
String modInfo = pxMod.getSkylineName() + ", " + Formula.normalizeFormula(mod.getFormula()) + ", " + mod.getAminoAcid() + ", TERM: " + term;
System.out.print("Skyline: " + modInfo);
System.out.println(" --- " + pxMod.getUnimodId() + ", " + pxMod.getName());
}
if (pxMod.hasPossibleUnimods())
{
String term = mod.getTerminus() == null ? "" : (mod.getTerminus().equals("N") ? "N-term" : "C-term");
String modInfo = pxMod.getSkylineName() + ", " + Formula.normalizeFormula(mod.getFormula()) + ", " + mod.getAminoAcid() + ", TERM: " + term;
System.out.println("Skyline: " + modInfo);
for (UnimodModification umod: pxMod.getPossibleUnimodMatches())
{
System.out.println(" --- List.of(new UnimodModification(" + umod.getId() + ", \"" + umod.getName() + "\", null))");
}
}
}

private Modification createMod(String name, String formula, String sites, String terminus)
{
Modification mod = new Modification();
Expand Down
8 changes: 4 additions & 4 deletions panoramapublic/test/src/org/labkey/test/tests/panoramapublic/PublicationSearchTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
import org.junit.experimental.categories.Category;
import org.labkey.remoteapi.CommandException;
import org.labkey.remoteapi.Connection;
import org.labkey.remoteapi.SimpleGetCommand;
import org.labkey.remoteapi.SimplePostCommand;
import org.labkey.remoteapi.query.Filter;
import org.labkey.remoteapi.query.SelectRowsCommand;
import org.labkey.remoteapi.query.SelectRowsResponse;
Expand Down Expand Up @@ -341,7 +341,7 @@ private void initMockNcbiService()
try
{
Connection connection = createDefaultConnection();
SimpleGetCommand command = new SimpleGetCommand("panoramapublic", "setupMockNcbiService");
SimplePostCommand command = new SimplePostCommand("panoramapublic", "setupMockNcbiService");
command.execute(connection, "/");
_useMockNcbi = true;
log("Using mock NCBI service");
Expand Down Expand Up @@ -417,7 +417,7 @@ private void registerMockPublication(String database, String id, String searchKe
try
{
Connection connection = createDefaultConnection();
SimpleGetCommand command = new SimpleGetCommand("panoramapublic", "registerMockPublication");
SimplePostCommand command = new SimplePostCommand("panoramapublic", "registerMockPublication");
Map<String, Object> params = new HashMap<>();
params.put("database", database);
params.put("id", id);
Expand Down Expand Up @@ -447,7 +447,7 @@ private void restoreNcbiService()
try
{
Connection connection = createDefaultConnection();
SimpleGetCommand command = new SimpleGetCommand("panoramapublic", "restoreNcbiService");
SimplePostCommand command = new SimplePostCommand("panoramapublic", "restoreNcbiService");
command.execute(connection, "/");
log("Restored real NCBI service");
}
Expand Down