-
Notifications
You must be signed in to change notification settings - Fork 1.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(taskAttachment): prevent NPE for deletion of attachments with empty or nonexisting taskId #4817
base: master
Are you sure you want to change the base?
Conversation
9a89b08
to
cd73812
Compare
<dependency> | ||
<groupId>org.apache.commons</groupId> | ||
<artifactId>commons-lang3</artifactId> | ||
</dependency> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Lmk if we prefer not to introduce this dependency for some reason, can also just do the StringUtils.isNotBlank
check manually.
3859a8a
to
997d9a0
Compare
@@ -2228,14 +2226,47 @@ public void testDeleteTaskAttachmentWithNullParameters() { | |||
} | |||
|
|||
@Test | |||
public void testDeleteTaskAttachmentWithTaskIdNull() { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Context:
I changed the name for this test case because to me it looks like the exception thrown here is thrown because the attachment was never created, not because the taskId is null (also made the exception assertion more specific for this reason)
Attachment attachment = taskService.createAttachment("web page", "", null, "weatherforcast", | ||
"temperatures and more", new ByteArrayInputStream("someContent".getBytes())); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Suggested follow up:
Based on my understanding of the issue, I think it would also make sense to look into prohibiting the creation of attachments with empty taskId and null (or empty) processInstanceId. At the moment, this is still allowed because the creation only checks for the taskId not being null. I can open a follow up ticket if you agree that this makes sense
7194bf2
to
00965bc
Compare
…ty or nonexisting taskId related to #3545
00965bc
to
a42a645
Compare
related to #3545
Behaviour is now:
Deleting a task attachment providing an empty taskID:
Deleting a task attachment with an ID of a task that has already been completed:
Note:
Due to this existing implementation, the
NullValueException
thrown in the Delete command will always be returned as anInvalidRequestException
as the API response. I am assuming this is expected behaviour, but lmk if that should be adjusted in any way.