Merge branch '16265-security-updates' into dependabot/bundler/apps/workbench/loofah...

[arvados.git] / apps / workbench / app / helpers / application_helper.rb

diff --git a/apps/workbench/app/helpers/application_helper.rb b/apps/workbench/app/helpers/application_helper.rb
index db6ae38c84371b6074bc7f7a7a9ec4b69172adfc..330d30976f93ff54cd6323c66a75b1c336e64ed7 100644 (file)
--- a/apps/workbench/app/helpers/application_helper.rb
+++ b/apps/workbench/app/helpers/application_helper.rb
@@ -1,3 +1,7 @@
+# Copyright (C) The Arvados Authors. All rights reserved.
+#
+# SPDX-License-Identifier: AGPL-3.0
+
 module ApplicationHelper
   def current_user
     controller.current_user
@@ -8,15 +12,24 @@ module ApplicationHelper
   end
 
   def current_api_host
-    Rails.configuration.arvados_v1_base.gsub /https?:\/\/|\/arvados\/v1/,''
+    if Rails.configuration.Services.Controller.ExternalURL.port == 443
+      "#{Rails.configuration.Services.Controller.ExternalURL.hostname}"
+    else
+      "#{Rails.configuration.Services.Controller.ExternalURL.hostname}:#{Rails.configuration.Services.Controller.ExternalURL.port}"
+    end
+  end
+
+  def current_uuid_prefix
+    Rails.configuration.ClusterID
   end
 
   def render_markup(markup)
-    raw RedCloth.new(markup.to_s).to_html(:refs_arvados, :textile) if markup
+    allowed_tags = Rails::Html::Sanitizer.white_list_sanitizer.allowed_tags + %w(table tbody th tr td col colgroup caption thead tfoot)
+    sanitize(raw(RedCloth.new(markup.to_s).to_html(:refs_arvados, :textile)), tags: allowed_tags) if markup
   end
 
   def human_readable_bytes_html(n)
-    return h(n) unless n.is_a? Fixnum
+    return h(n) unless n.is_a? Integer
     return "0 bytes" if (n == 0)
 
     orders = {
@@ -39,13 +52,6 @@ module ApplicationHelper
     end
 
     return h(n)
-    #raw = n.to_s
-    #cooked = ''
-    #while raw.length > 3
-    #  cooked = ',' + raw[-3..-1] + cooked
-    #  raw = raw[0..-4]
-    #end
-    #cooked = raw + cooked
   end
 
   def resource_class_for_uuid(attrvalue, opts={})
@@ -357,8 +363,8 @@ module ApplicationHelper
           display_value = link.name
         elsif value_info[:link_name]
           display_value = value_info[:link_name]
-        elsif value_info[:selection_name]
-          display_value = value_info[:selection_name]
+        elsif (sn = value_info[:selection_name]) && sn != ""
+          display_value = sn
         end
       end
       if (attr == :components) and (subattr.size > 2)
@@ -422,18 +428,23 @@ module ApplicationHelper
     lt
   end
 
-  def get_cwl_inputs(workflow)
-    if workflow[:inputs]
-      return workflow[:inputs]
+  def get_cwl_main(workflow)
+    if workflow[:"$graph"].nil?
+      return workflow
     else
       workflow[:"$graph"].each do |tool|
         if tool[:id] == "#main"
-          return tool[:inputs]
+          return tool
         end
       end
     end
   end
 
+  def get_cwl_inputs(workflow)
+    get_cwl_main(workflow)[:inputs]
+  end
+
+
   def cwl_shortname(id)
     if id[0] == "#"
       id = id[1..-1]
@@ -467,8 +478,8 @@ module ApplicationHelper
   def cwl_inputs_required(object, inputs_schema, set_attr_path)
     r = 0
     inputs_schema.each do |input|
-      required, primary_type, param_id = cwl_input_info(input)
-      dn, attrvalue = cwl_input_value(object, input, set_attr_path + [param_id])
+      required, _, param_id = cwl_input_info(input)
+      _, attrvalue = cwl_input_value(object, input, set_attr_path + [param_id])
       r += 1 if required and attrvalue.nil?
     end
     r
@@ -488,11 +499,12 @@ module ApplicationHelper
       chooser_title = "Choose a #{primary_type == 'Directory' ? 'dataset' : 'file'}:"
       selection_param = object.class.to_s.underscore + dn
       if attrvalue.is_a? Hash
-        display_value = attrvalue[:"arv:collection"] || attrvalue[:location]
+        display_value = attrvalue[:"http://arvados.org/cwl#collectionUUID"] || attrvalue[:"arv:collection"] || attrvalue[:location]
         re = CollectionsHelper.match_uuid_with_optional_filepath(display_value)
+        locationre = CollectionsHelper.match(attrvalue[:location][5..-1])
         if re
-          if re[4]
-            display_value = "#{Collection.find(re[1]).name} / #{re[4][1..-1]}"
+          if locationre and locationre[4]
+            display_value = "#{Collection.find(re[1]).name} / #{locationre[4][1..-1]}"
           else
             display_value = Collection.find(re[1]).name
           end
@@ -670,14 +682,15 @@ module ApplicationHelper
     render_runtime duration, use_words, round_to_min
   end
 
-  # Keep locators are expected to be of the form \"...<pdh/file_path>\"
-  KEEP_LOCATOR_REGEXP = /(.*)(([0-9a-f]{32}\+\d+)(.*)\"(.*))/
+  # Keep locators are expected to be of the form \"...<pdh/file_path>\" or \"...<uuid/file_path>\"
+  JSON_KEEP_LOCATOR_REGEXP = /([0-9a-f]{32}\+\d+[^'"]*|[a-z0-9]{5}-4zz18-[a-z0-9]{15}[^'"]*)(?=['"]|\z|$)/
   def keep_locator_in_json str
-    KEEP_LOCATOR_REGEXP.match str
+    # Return a list of all matches
+    str.scan(JSON_KEEP_LOCATOR_REGEXP).flatten
   end
 
 private
   def is_textile?( object, attr )
-    is_textile = object.textile_attributes.andand.include?(attr)
+    object.textile_attributes.andand.include?(attr)
   end
 end