Merge branch 'release_23.0' into dev

client/package.json

@@ -55,6 +55,7 @@
     "date-fns-tz": "^1.3.3",
     "decode-uri-component": "^0.2.1",
     "dom-to-image": "^2.6.0",
+    "dompurify": "^3.0.1",
     "dumpmeta-webpack-plugin": "^0.2.0",
     "elkjs": "^0.7.1",
     "file-saver": "^2.0.5",

client/src/components/Libraries/LibraryEditField.vue

@@ -7,17 +7,20 @@
             </div>
             <!-- shrink long text -->
             <div v-else-if="text.length > maxDescriptionLength && !isExpanded">
+                <!-- eslint-disable vue/no-v-html -->
                 <span
                     class="shrinked-description"
                     :title="text"
-                    v-html="linkify(text.substring(0, maxDescriptionLength))">
+                    v-html="linkify(sanitize(text.substring(0, maxDescriptionLength)))">
                 </span>
+                <!-- eslint-enable vue/no-v-html -->
                 <span :title="text">...</span>
                 <a class="more-text-btn" href="javascript:void(0)" @click="toggleDescriptionExpand">(more) </a>
             </div>
             <!-- Regular -->
             <div v-else>
-                <div v-html="linkify(text)"></div>
+                <!-- eslint-disable-next-line vue/no-v-html -->
+                <div v-html="linkify(sanitize(text))"></div>
                 <!-- hide toggle expand if text is too short -->
                 <a
                     v-if="text.length > maxDescriptionLength"
@@ -37,6 +40,7 @@ import BootstrapVue from "bootstrap-vue";
 import Vue from "vue";
 
 import linkifyHtml from "linkify-html";
+import { sanitize } from "dompurify";
 Vue.use(BootstrapVue);
 
 export default {
@@ -60,6 +64,7 @@ export default {
         };
     },
     methods: {
+        sanitize,
         updateValue(value) {
             this.$emit("update:changedValue", value);
         },

client/src/components/Libraries/LibraryFolder/LibraryFolder.vue

@@ -129,17 +129,20 @@
                                     getMessage(row.item).length > maxDescriptionLength &&
                                     !expandedMessage.includes(row.item.id)
                                 ">
+                                <!-- eslint-disable vue/no-v-html -->
                                 <span
                                     class="shrinked-description"
                                     :title="getMessage(row.item)"
-                                    v-html="linkify(getMessage(row.item).substring(0, maxDescriptionLength))">
+                                    v-html="linkify(sanitize(getMessage(row.item).substring(0, maxDescriptionLength)))">
                                 </span>
+                                <!-- eslint-enable vue/no-v-html -->
                                 <span :title="getMessage(row.item)"> ...</span>
                                 <a class="more-text-btn" href="javascript:void(0)" @click="expandMessage(row.item)"
                                     >(more)</a
                                 >
                             </div>
-                            <div v-else v-html="linkify(getMessage(row.item))"></div>
+                            <!-- eslint-disable-next-line vue/no-v-html -->
+                            <div v-else v-html="linkify(sanitize(getMessage(row.item)))"></div>
                         </div>
                     </div>
                 </template>
@@ -269,6 +272,7 @@
 
 <script>
 import Vue from "vue";
+import { sanitize } from "dompurify";
 import { getAppRoot } from "onload/loadConfig";
 import UtcDate from "components/UtcDate";
 import BootstrapVue from "bootstrap-vue";
@@ -359,6 +363,7 @@ export default {
         this.getFolder(this.folder_id, this.page);
     },
     methods: {
+        sanitize,
         getFolder(folder_id, page) {
             this.currentFolderId = folder_id;
             this.currentPage = page;

client/src/components/Workflow/Import/TrsImport.vue

@@ -41,7 +41,9 @@ const trsSelection: Ref<TrsSelection | null> = ref(null);
 const errorMessage: Ref<string | null> = ref(null);
 const toolId = ref(props.queryTrsId);
 const isAnonymous: Ref<boolean> = getGalaxyInstance().user?.isAnonymous();
-const isAutoImport = ref(Boolean(props.queryTrsVersionId && props.queryTrsServer && props.queryTrsId));
+const isAutoImport = ref(
+    Boolean((props.queryTrsVersionId && props.queryTrsServer && props.queryTrsId) || props.queryTrsUrl)
+);
 
 const toolIdTrimmed = computed(() => {
     return toolId.value?.trim() || null;
@@ -186,7 +188,9 @@ async function importVersionFromUrl(url: string, isRunFormRedirect = false) {
             </div>
             <hr />
             <div>
-                <TrsUrlImport :query-trs-url="props.queryTrsUrl" @onImport="(url) => importVersionFromUrl(url)" />
+                <TrsUrlImport
+                    :query-trs-url="props.queryTrsUrl"
+                    @onImport="(url) => importVersionFromUrl(url, isRun)" />
             </div>
         </b-card>
         <b-alert v-else class="text-center my-2" show variant="danger">

client/yarn.lock

@@ -4874,6 +4874,11 @@ dompurify@^2.2.0:
   resolved "https://registry.npmjs.org/dompurify/-/dompurify-2.3.10.tgz"
   integrity sha512-o7Fg/AgC7p/XpKjf/+RC3Ok6k4St5F7Q6q6+Nnm3p2zGWioAY6dh0CbbuwOhH2UcSzKsdniE/YnE2/92JcsA+g==
 
+dompurify@^3.0.1:
+  version "3.0.1"
+  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.0.1.tgz#a0933f38931b3238934dd632043b727e53004289"
+  integrity sha512-60tsgvPKwItxZZdfLmamp0MTcecCta3avOhsLgPZ0qcWt96OasFfhkeIRbJ6br5i0fQawT1/RBGB5L58/Jpwuw==
+
 domutils@^2.8.0:
   version "2.8.0"
   resolved "https://registry.npmjs.org/domutils/-/domutils-2.8.0.tgz"

lib/galaxy/actions/library.py

@@ -333,7 +333,7 @@ def _check_access(self, trans, is_admin, item, current_user_roles):
                 raise ObjectNotFound(message)
             elif (
                 not trans.app.security_agent.can_access_dataset(current_user_roles, item.dataset)
-                and item.history.user == trans.user
+                and item.user == trans.user
             ):
                 message = f"You do not have permission to access the history dataset with id ({str(item.id)})."
                 raise ItemAccessibilityException(message)

lib/galaxy/app.py

@@ -190,22 +190,19 @@ def configure_sentry_client(self):
                 "CRITICAL",
             ], f"Invalid sentry event level '{self.config.sentry.event_level}'"
 
-            def postfork_sentry_client():
-                import sentry_sdk
-                from sentry_sdk.integrations.logging import LoggingIntegration
-
-                sentry_logging = LoggingIntegration(
-                    level=logging.INFO,  # Capture info and above as breadcrumbs
-                    event_level=getattr(logging, event_level),  # Send errors as events
-                )
-                self.sentry_client = sentry_sdk.init(
-                    self.config.sentry_dsn,
-                    release=f"{self.config.version_major}.{self.config.version_minor}",
-                    integrations=[sentry_logging],
-                    traces_sample_rate=self.config.sentry_traces_sample_rate,
-                )
-
-            self.application_stack.register_postfork_function(postfork_sentry_client)
+            import sentry_sdk
+            from sentry_sdk.integrations.logging import LoggingIntegration
+
+            sentry_logging = LoggingIntegration(
+                level=logging.INFO,  # Capture info and above as breadcrumbs
+                event_level=getattr(logging, event_level),  # Send errors as events
+            )
+            self.sentry_client = sentry_sdk.init(
+                self.config.sentry_dsn,
+                release=f"{self.config.version_major}.{self.config.version_minor}",
+                integrations=[sentry_logging],
+                traces_sample_rate=self.config.sentry_traces_sample_rate,
+            )
 
 
 class MinimalGalaxyApplication(BasicSharedApp, HaltableContainer, SentryClientMixin):

lib/galaxy/dependencies/pinned-requirements.txt

@@ -49,7 +49,7 @@ cloudauthz==0.6.0 ; python_version >= "3.7" and python_version < "3.12"
 cloudbridge==3.1.0 ; python_version >= "3.7" and python_version < "3.12"
 colorama==0.4.6 ; python_version >= "3.7" and python_version < "3.12" and platform_system == "Windows"
 coloredlogs==15.0.1 ; python_version >= "3.7" and python_version < "3.12"
-conda_package_streaming==0.7.0 ; python_version >= "3.7" and python_version < "3.12"
+conda-package-streaming==0.7.0 ; python_version >= "3.7" and python_version < "3.12"
 cryptography==39.0.0 ; python_version >= "3.7" and python_version < "3.12"
 cwl-upgrader==1.2.4 ; python_version >= "3.7" and python_version < "3.12"
 cwl-utils==0.23 ; python_version >= "3.7" and python_version < "3.12"

lib/galaxy/managers/hdas.py

@@ -182,7 +182,7 @@ def copy(
         copy.set_size()
 
         original_annotation = self.annotation(hda)
-        self.annotate(copy, original_annotation, user=hda.history.user, flush=False)
+        self.annotate(copy, original_annotation, user=hda.user, flush=False)
         if flush:
             if history:
                 history.add_pending_items()
@@ -293,7 +293,7 @@ def text_data(self, hda, preview=True):
     # .... annotatable
     def annotation(self, hda):
         # override to scope to history owner
-        return self._user_annotation(hda, hda.history.user)
+        return self._user_annotation(hda, hda.user)
 
     def _set_permissions(self, trans, hda, role_ids_dict):
         # The user associated the DATASET_ACCESS permission on the dataset with 1 or more roles.  We

lib/galaxy/managers/histories.py

@@ -544,8 +544,6 @@ def add_serializers(self):
             "contents_url": lambda item, key, **context: self.url_for(
                 "history_contents", history_id=self.app.security.encode_id(item.id), context=context
             ),
-            "empty": lambda item, key, **context: (len(item.datasets) + len(item.dataset_collections)) <= 0,
-            "count": lambda item, key, **context: len(item.datasets),
             "hdas": lambda item, key, **context: [self.app.security.encode_id(hda.id) for hda in item.datasets],
             "state_details": self.serialize_state_counts,
             "state_ids": self.serialize_state_ids,

lib/galaxy/managers/interactivetool.py

@@ -211,6 +211,9 @@ def create_interactivetool(self, job, tool, entry_points):
             )
 
     def get_nonterminal_for_user_by_trans(self, trans):
+        if trans.user is None and trans.get_galaxy_session() is None:
+            return []
+
         if trans.user:
             jobs = trans.sa_session.query(trans.app.model.Job).filter(trans.app.model.Job.user == trans.user)
         else:

lib/galaxy/model/__init__.py

@@ -4795,6 +4795,11 @@ def __init__(
         self.copied_from_history_dataset_association = copied_from_history_dataset_association
         self.copied_from_library_dataset_dataset_association = copied_from_library_dataset_dataset_association
 
+    @property
+    def user(self):
+        if self.history:
+            return self.history.user
+
     def __create_version__(self, session):
         state = inspect(self)
         changes = {}
@@ -4842,7 +4847,7 @@ def copy_from(self, other_hda, new_dataset=None, include_tags=True, include_meta
         self.validated_state = other_hda.validated_state
         self.validated_state_message = other_hda.validated_state_message
         if include_tags and self.history:
-            self.copy_tags_from(self.history.user, other_hda)
+            self.copy_tags_from(self.user, other_hda)
         self.dataset = new_dataset or other_hda.dataset
         if old_dataset:
             old_dataset.full_delete()
@@ -4993,7 +4998,7 @@ def quota_amount(self, user):
             for hda in self.dataset.history_associations:
                 if hda.id == self.id:
                     continue
-                if not hda.purged and hda.history and hda.history.user and hda.history.user == user:
+                if not hda.purged and hda.history and hda.user and hda.user == user:
                     break
             else:
                 rval += self.get_total_size()

lib/galaxy/model/store/__init__.py

@@ -105,7 +105,7 @@
 )
 from ._bco_convert_utils import (
     bco_workflow_version,
-    SoftwarePrerequisteTracker,
+    SoftwarePrerequisiteTracker,
 )
 from .ro_crate_utils import WorkflowRunCrateProfileBuilder
 from ..custom_types import json_encoder
@@ -2547,7 +2547,7 @@ def get_dataset_url(encoded_dataset_id: str):
 
         # metrics = {}  ... TODO
         pipeline_steps: List[PipelineStep] = []
-        software_prerequisite_tracker = SoftwarePrerequisteTracker()
+        software_prerequisite_tracker = SoftwarePrerequisiteTracker()
         input_subdomain_items: List[InputSubdomainItem] = []
         output_subdomain_items: List[OutputSubdomainItem] = []
         for step in workflow_invocation.steps:

lib/galaxy/model/store/_bco_convert_utils.py

@@ -1,3 +1,4 @@
+import urllib.parse
 from typing import (
     List,
     Set,
@@ -13,7 +14,7 @@
 )
 
 
-class SoftwarePrerequisteTracker:
+class SoftwarePrerequisiteTracker:
     _recorded_tools: Set[str] = set()
     _software_prerequisites: List[SoftwarePrerequisite] = []
 
@@ -27,11 +28,12 @@ def register_step(self, step: WorkflowStep) -> None:
 
         tool_version = step.tool_version
         self._recorded_tools.add(tool_id)
+        uri_safe_tool_id = urllib.parse.quote(tool_id)
         if "repos/" in tool_id:
             # tool shed tool - give them a link...
-            uri = f"https://{tool_id}"
+            uri = f"https://{uri_safe_tool_id}"
         else:
-            uri = f"gxstocktools://{tool_id}"
+            uri = f"gxstocktools://galaxyproject.org/{uri_safe_tool_id}"
 
         access_time = None  # used to be uuid - but Pydanic validation... rightfully... disallows this
         software_prerequisite = SoftwarePrerequisite(

lib/galaxy/tool_util/deps/mulled/util.py

@@ -381,16 +381,13 @@ def get_file_from_conda_package(
         checklist = set([checklist])
     else:
         checklist = set(checklist)
-    # print(checklist)
     try:
         stream = stream_conda_info(url)
     except FileNotFoundError:
         stream = stream_conda_info_from_url(url)
     for tar, member in stream:
-        # print(member.name)
         if member.name in checklist:
             return member.name, tar.extractfile(member).read()
-    # print("None")
     return None, None
 
 

lib/galaxy/tools/__init__.py

@@ -2301,8 +2301,8 @@ def parse_redirect_url(self, data, param_dict):
         for p_name in rup_dict:
             redirect_url += f"&{p_name}={rup_dict[p_name]}"
         # Add the current user email to redirect_url
-        if data.history.user:
-            USERNAME = str(data.history.user.email)
+        if data.user:
+            USERNAME = str(data.user.email)
         else:
             USERNAME = "Anonymous"
         redirect_url += f"&USERNAME={USERNAME}"

lib/galaxy/webapps/base/controller.py

@@ -1077,7 +1077,7 @@ def get_hda(self, trans, dataset_id, check_ownership=True, check_accessible=Fals
             user = trans.get_user()
             if not user:
                 error("Must be logged in to manage Galaxy items")
-            if data.history.user != user:
+            if data.user != user:
                 error(f"{data.__class__.__name__} is not owned by current user")
 
         if check_accessible:

lib/galaxy/webapps/base/webapp.py

@@ -815,7 +815,7 @@ def _associate_user_history(self, user, prev_galaxy_session=None):
             prev_galaxy_session
             and prev_galaxy_session.current_history
             and not prev_galaxy_session.current_history.deleted
-            and prev_galaxy_session.current_history.datasets
+            and not prev_galaxy_session.current_history.empty
             and (prev_galaxy_session.current_history.user is None or prev_galaxy_session.current_history.user == user)
         ):
             # If the previous galaxy session had a history, associate it with the new session, but only if it didn't
@@ -959,7 +959,7 @@ def get_or_create_default_history(self):
         )
         default_history = None
         for history in unnamed_histories:
-            if len(history.datasets) == 0:
+            if history.empty:
                 # Found suitable default history.
                 default_history = history
                 break

lib/galaxy/webapps/galaxy/api/datasets.py

@@ -258,7 +258,9 @@ def display(
         ),
     ):
         """Streams the dataset for download or the contents preview to be displayed in a browser."""
-        extra_params = get_query_parameters_from_request_excluding(request, {"preview", "filename", "to_ext", "raw"})
+        extra_params = get_query_parameters_from_request_excluding(
+            request, {"preview", "filename", "to_ext", "raw", "dataset"}
+        )
         display_data, headers = self.service.display(
             trans, history_content_id, preview=preview, filename=filename, to_ext=to_ext, raw=raw, **extra_params
         )