Skip to content

Conversation

@labkey-tchad
Copy link
Member

Rationale

Error discovered by crawler:

java.lang.NumberFormatException: For input string: "">'>'"<script>alert('8(')</script>"
	at java.base/java.lang.NumberFormatException.forInputString(NumberFormatException.java:67)
	at java.base/java.lang.Integer.parseInt(Integer.java:654)
	at java.base/java.lang.Integer.valueOf(Integer.java:999)
	at org.labkey.hdrl.query.HDRLQuerySchema.createView(HDRLQuerySchema.java:238)
	at org.labkey.api.query.QueryForm.init(QueryForm.java:336)
	at org.labkey.api.query.QueryForm.getQueryView(QueryForm.java:81)
	at org.labkey.query.controllers.QueryController$ExecuteQueryAction.getView(QueryController.java:1641)
	at org.labkey.query.controllers.QueryController$ExecuteQueryAction.getView(QueryController.java:1629)

Related Pull Requests

  • N/A

Changes

  • Handle invalid request ID in HDRLQuerySchema

@labkey-tchad labkey-tchad requested a review from a team December 3, 2025 19:01
@labkey-tchad labkey-tchad self-assigned this Dec 3, 2025
@labkey-tchad labkey-tchad merged commit f5ca56e into develop Dec 3, 2025
9 checks passed
@labkey-tchad labkey-tchad deleted the fb_fixBadParameterHandling branch December 3, 2025 22:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants