[NAE-2303] TaskRef Security Improvements

application-engine/pom.xml

@@ -270,18 +270,6 @@
             <version>${junit-jupiter.version}</version>
             <scope>test</scope>
         </dependency>
-        <dependency>
-            <groupId>org.junit.jupiter</groupId>
-            <artifactId>junit-jupiter-api</artifactId>
-            <version>${junit-jupiter.version}</version>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.junit.jupiter</groupId>
-            <artifactId>junit-jupiter-engine</artifactId>
-            <version>${junit-jupiter.version}</version>
-            <scope>test</scope>
-        </dependency>
         <!-- Groovy -->
         <!-- https://mvnrepository.com/artifact/org.codehaus.groovy/groovy-all -->
         <dependency>

application-engine/src/main/java/com/netgrif/application/engine/workflow/service/DataService.java

@@ -71,6 +71,8 @@ public class DataService implements IDataService {
 
     public static final int MONGO_ID_LENGTH = 24;
 
+    private static final Set<FieldType> setDataForbiddenFieldTypes = Set.of(FieldType.TASK_REF, FieldType.CASE_REF);
+
     @Autowired
     protected ApplicationEventPublisher publisher;
 
@@ -220,6 +222,22 @@ public SetDataEventOutcome setData(Task task, ObjectNode values) {
 
     @Override
     public SetDataEventOutcome setData(Task task, ObjectNode values, Map<String, String> params) {
+        return setData(task, values, params, false);
+    }
+
+    /**
+     * Updates the data field's attributes of the provided task.
+     *
+     * @param task the task object of which the data are updated
+     * @param values information about how to update the data fields
+     * @param params additional information to be injected to the action delegate context
+     * @param runStrict if set to true, additional validations are going to be applied when updating the data fields. If
+     *                set to false, minimal restrictions are considered.
+     *
+     * @return outcome containing Case, Task and changes that have been made.
+     * */
+    @Override
+    public SetDataEventOutcome setData(Task task, ObjectNode values, Map<String, String> params, boolean runStrict) {
         Case useCase = workflowService.findOne(task.getCaseId());
         AbstractUser user = userService.getLoggedOrSystem();
 
@@ -232,77 +250,100 @@ public SetDataEventOutcome setData(Task task, ObjectNode values, Map<String, Str
         values.fields().forEachRemaining(entry -> {
             String fieldId = entry.getKey();
             DataField dataField = useCase.getDataSet().get(fieldId);
-            if (dataField != null) {
-                Field field = useCase.getPetriNet().getField(fieldId).get();
-                outcome.addOutcomes(resolveDataEvents(field, DataEventType.SET, EventPhase.PRE, useCase, task, params));
-                if (outcome.getMessage() == null) {
-                    Map<String, DataFieldLogic> dataSet = useCase.getPetriNet().getTransition(task.getTransitionId()).getDataSet();
-                    if (field.getEvents().containsKey(DataEventType.SET) &&
-                            ((DataEvent) field.getEvents().get(DataEventType.SET)).getMessage() != null) {
-                        outcome.setMessage(((DataEvent) field.getEvents().get(DataEventType.SET)).getMessage());
-                    } else if (dataSet.containsKey(fieldId)
-                            && dataSet.get(fieldId).getEvents().containsKey(DataEventType.SET)
-                            && dataSet.get(fieldId).getEvents().get(DataEventType.SET).getMessage() != null) {
-                        outcome.setMessage(dataSet.get(fieldId).getEvents().get(DataEventType.SET).getMessage());
-                    }
-                }
-                boolean modified = false;
-                ChangedField changedField = new ChangedField();
-                changedField.setId(fieldId);
-                Object newValue = parseFieldsValues(entry.getValue(), dataField, task.getStringId());
-                if (entry.getValue().has("value") || getFieldTypeFromNode((ObjectNode) entry.getValue()).equals("button")) {
-                    dataField.setValue(newValue);
-                    changedField.addAttribute("value", newValue);
-                    modified = true;
-                }
-                List<String> allowedNets = parseAllowedNetsValue(entry.getValue());
-                if (allowedNets != null) {
-                    dataField.setAllowedNets(allowedNets);
-                    changedField.addAttribute("allowedNets", allowedNets);
-                    modified = true;
-                }
-                String fieldType = getFieldTypeFromNode((ObjectNode) entry.getValue());
-                Map<String, Object> filterMetadata = parseFilterMetadataValue((ObjectNode) entry.getValue(), fieldType);
-                if (filterMetadata != null) {
-                    dataField.setFilterMetadata(filterMetadata);
-                    changedField.addAttribute("filterMetadata", filterMetadata);
-                    modified = true;
-                }
-                Map<String, I18nString> options = parseOptionsNode(entry.getValue(), fieldType);
-                if (options != null) {
-                    setDataFieldOptions(options, dataField, changedField, fieldType);
-                    modified = true;
-                }
-                Set<I18nString> choices = parseChoicesNode((ObjectNode) entry.getValue(), fieldType);
-                if (choices != null) {
-                    dataField.setChoices(choices);
-                    changedField.addAttribute("choices", choices.stream().map(i18nString -> i18nString.getTranslation(LocaleContextHolder.getLocale())).collect(Collectors.toSet()));
-                    modified = true;
+            if (dataField == null) {
+                return;
+            }
+            if (runStrict) {
+                if (!isDataFieldEditable(dataField, task.getTransitionId())) {
+                    throw new IllegalArgumentException("Cannot edit data field [" + fieldId + "], which is not editable on transition [" + task.getTransitionId() + "].");
                 }
-                Map<String, String> properties = parseProperties(entry.getValue());
-                if (properties != null) {
-                    outcome.addOutcome(this.changeComponentProperties(useCase, task, field.getStringId(), properties));
-                    modified = true;
+                Field<?> field = useCase.getField(fieldId);
+                if (field == null) {
+                    throw new IllegalArgumentException("Such field with id [" + fieldId + "] does not exist in petri net [" + useCase.getPetriNetId() + "]");
                 }
-                if (modified) {
-                    dataField.setLastModified(LocalDateTime.now());
+                if (setDataForbiddenFieldTypes.contains(field.getType())) {
+                    return;
                 }
-                if (dataConfigurationProperties.getValidation().isSetDataEnabled()) {
-                    validation.valid(useCase.getPetriNet().getDataSet().get(entry.getKey()), dataField);
+            }
+
+            Field field = useCase.getPetriNet().getField(fieldId).get();
+            outcome.addOutcomes(resolveDataEvents(field, DataEventType.SET, EventPhase.PRE, useCase, task, params));
+            if (outcome.getMessage() == null) {
+                Map<String, DataFieldLogic> dataSet = useCase.getPetriNet().getTransition(task.getTransitionId()).getDataSet();
+                if (field.getEvents().containsKey(DataEventType.SET) &&
+                        ((DataEvent) field.getEvents().get(DataEventType.SET)).getMessage() != null) {
+                    outcome.setMessage(((DataEvent) field.getEvents().get(DataEventType.SET)).getMessage());
+                } else if (dataSet.containsKey(fieldId)
+                        && dataSet.get(fieldId).getEvents().containsKey(DataEventType.SET)
+                        && dataSet.get(fieldId).getEvents().get(DataEventType.SET).getMessage() != null) {
+                    outcome.setMessage(dataSet.get(fieldId).getEvents().get(DataEventType.SET).getMessage());
                 }
-                outcome.addChangedField(fieldId, changedField);
-                workflowService.save(useCase);
-                publisher.publishEvent(new SetDataEvent(outcome, EventPhase.PRE, user));
-                outcome.addOutcomes(resolveDataEvents(field, DataEventType.SET, EventPhase.POST, useCase, task, params));
-                applyFieldConnectedChanges(useCase, field);
             }
+            boolean modified = false;
+            ChangedField changedField = new ChangedField();
+            changedField.setId(fieldId);
+            Object newValue = parseFieldsValues(entry.getValue(), dataField, task.getStringId());
+            if (entry.getValue().has("value") || getFieldTypeFromNode((ObjectNode) entry.getValue()).equals("button")) {
+                dataField.setValue(newValue);
+                changedField.addAttribute("value", newValue);
+                modified = true;
+            }
+            List<String> allowedNets = parseAllowedNetsValue(entry.getValue());
+            if (allowedNets != null) {
+                dataField.setAllowedNets(allowedNets);
+                changedField.addAttribute("allowedNets", allowedNets);
+                modified = true;
+            }
+            String fieldType = getFieldTypeFromNode((ObjectNode) entry.getValue());
+            Map<String, Object> filterMetadata = parseFilterMetadataValue((ObjectNode) entry.getValue(), fieldType);
+            if (filterMetadata != null) {
+                dataField.setFilterMetadata(filterMetadata);
+                changedField.addAttribute("filterMetadata", filterMetadata);
+                modified = true;
+            }
+            Map<String, I18nString> options = parseOptionsNode(entry.getValue(), fieldType);
+            if (options != null) {
+                setDataFieldOptions(options, dataField, changedField, fieldType);
+                modified = true;
+            }
+            Set<I18nString> choices = parseChoicesNode((ObjectNode) entry.getValue(), fieldType);
+            if (choices != null) {
+                dataField.setChoices(choices);
+                changedField.addAttribute("choices", choices.stream().map(i18nString -> i18nString.getTranslation(LocaleContextHolder.getLocale())).collect(Collectors.toSet()));
+                modified = true;
+            }
+            Map<String, String> properties = parseProperties(entry.getValue());
+            if (properties != null) {
+                outcome.addOutcome(this.changeComponentProperties(useCase, task, field.getStringId(), properties));
+                modified = true;
+            }
+            if (modified) {
+                dataField.setLastModified(LocalDateTime.now());
+            }
+            if (dataConfigurationProperties.getValidation().isSetDataEnabled()) {
+                validation.valid(useCase.getPetriNet().getDataSet().get(entry.getKey()), dataField);
+            }
+            outcome.addChangedField(fieldId, changedField);
+            workflowService.save(useCase);
+            publisher.publishEvent(new SetDataEvent(outcome, EventPhase.PRE, user));
+            outcome.addOutcomes(resolveDataEvents(field, DataEventType.SET, EventPhase.POST, useCase, task, params));
+            applyFieldConnectedChanges(useCase, field);
         });
         updateDataset(useCase);
         outcome.setCase(workflowService.save(useCase));
         publisher.publishEvent(new SetDataEvent(outcome));
         return outcome;
     }
 
+    private boolean isDataFieldEditable(DataField dataField, String transId) {
+        Map<String, Set<FieldBehavior>> behaviorMap = dataField.getBehavior();
+        if (behaviorMap == null) {
+            return false;
+        }
+        Set<FieldBehavior> behaviorSet = behaviorMap.get(transId);
+        return behaviorSet != null && behaviorSet.contains(FieldBehavior.EDITABLE);
+    }
+
     @Override
     public GetDataGroupsEventOutcome getDataGroups(String taskId, Locale locale) {
         return getDataGroups(taskId, locale, new HashSet<>(), 0, null);

application-engine/src/main/java/com/netgrif/application/engine/workflow/service/TaskService.java

@@ -976,6 +976,9 @@ public SetDataEventOutcome getMainOutcome(Map<String, SetDataEventOutcome> outco
             }
         }
         mainOutcome = outcomes.remove(key);
+        if (mainOutcome == null) {
+            return null;
+        }
         mainOutcome.addOutcomes(new ArrayList<>(outcomes.values()));
         return mainOutcome;
     }

application-engine/src/main/java/com/netgrif/application/engine/workflow/service/interfaces/IDataService.java

@@ -41,6 +41,8 @@ public interface IDataService {
 
     SetDataEventOutcome setData(Task task, ObjectNode values, Map<String, String> params);
 
+    SetDataEventOutcome setData(Task task, ObjectNode values, Map<String, String> params, boolean runStrict);
+
     FileFieldInputStream getFile(Case useCase, Task task, FileField field, boolean forPreview) throws FileNotFoundException;
 
     FileFieldInputStream getFile(Case useCase, Task task, FileField field, boolean forPreview, Map<String, String> params) throws FileNotFoundException;