Add explicit permissions to GitHub workflows

.github/workflows/branch_release.yml

@@ -8,6 +8,10 @@ on:
     tags:
       - '*'
 
+permissions:
+  pull-requests: write
+  contents: write
+
 jobs:
   branch_release:
     if: github.event.created && github.event.sender.login == 'labkey-teamcity'

.github/workflows/merge_release.yml

@@ -8,6 +8,10 @@ on:
     types:
       - submitted
 
+permissions:
+  pull-requests: write
+  contents: write
+
 jobs:
   merge_release:
     if: >

.github/workflows/validate_pr.yml

@@ -10,6 +10,9 @@ on:
       - reopened
       - ready_for_review
 
+permissions:
+  pull-requests: read
+
 jobs:
   validate_pr:
     if: github.event.pull_request.head.repo.owner.login == 'LabKey'

modules/simpletest/resources/scripts/validationTest/actionUrlTest.js

@@ -21,21 +21,21 @@ function doTest()
 
     if (contextPath.length > 0) {
         var baseUrl = LABKEY.ActionURL.getBaseURL();
-        if (baseUrl.indexOf("labkey/") != baseUrl.length - 7)
+        if (!baseUrl.endsWith(contextPath + "/"))
             errors[errors.length] = new Error("ActionURL.getBaseURL() = " + baseUrl);
     }
 
     var queryString = LABKEY.ActionURL.queryString(urlParameters);
-    if( queryString != 'x=fred&y=barney' )
+    if( queryString !== 'x=fred&y=barney' )
         errors[errors.length] = new Error("ActionURL.queryString = " + queryString);
 
     var url = LABKEY.ActionURL.buildURL(controller, action, containerPath, urlParameters);
-    if( url != contextPath + "/" + controller + "/" + containerPath + "/" + action + ".view?" + queryString  &&
-        url != contextPath + "/" + containerPath + "/" + controller + "-" + action + ".view?" + queryString)
+    if( url !== contextPath + "/" + controller + "/" + containerPath + "/" + action + ".view?" + queryString  &&
+        url !== contextPath + "/" + containerPath + "/" + controller + "-" + action + ".view?" + queryString)
         errors[errors.length] = new Error("ActionURL.buildUrl() = " + url);
 
     var parameters = LABKEY.ActionURL.getParameters(url);
-    if( Ext.util.JSON.encode(parameters) != Ext.util.JSON.encode(urlParameters) )
+    if( Ext.util.JSON.encode(parameters) !== Ext.util.JSON.encode(urlParameters) )
         errors[errors.length] = new Error("ActionURL.getParameters() = " + Ext.util.JSON.encode(parameters));
 
     if( errors.length > 0 )

src/org/labkey/test/BaseWebDriverTest.java

@@ -543,7 +543,7 @@ Statement createFailOnTimeoutStatement(Statement statement, Class<?> testClass)
                 else
                     minutes = ClassTimeout.DEFAULT;
 
-                minutes *= timeoutMultiplier;
+                minutes = Math.round(minutes * timeoutMultiplier);
 
                 if (minutes == 0)
                     minutes = 1;

src/org/labkey/test/TestFileUtils.java

@@ -632,9 +632,15 @@ private static List<File> unTar(final File inputFile, final File outputDir) thro
              TarArchiveInputStream inputStream = new ArchiveStreamFactory().createArchiveInputStream("tar", is))
         {
             TarArchiveEntry entry;
+            Path normalizedOutputPath = outputDir.toPath().normalize();
+
             while ((entry = inputStream.getNextEntry()) != null)
             {
                 final File outputFile = new File(outputDir, entry.getName());
+
+                if (!outputFile.toPath().normalize().startsWith(normalizedOutputPath))
+                    throw new IOException("Bad zip entry (" + entry.getName() + ") in " + inputFile.getAbsolutePath());
+
                 if (entry.isDirectory())
                 {
                     if (!outputFile.exists())

src/org/labkey/test/tests/SpecimenTest.java

@@ -825,7 +825,7 @@ private void verifyRequestingLocationCounts(StudyLocationType... types)
         waitForElement(Locators.bodyTitle().withText("New Specimen Request"));
         int expectedLocationCount = StudyLocationType.untypedSites();
 
-        long additionalLocations = Math.round(Math.pow(2, StudyLocationType.values().length - 1));
+        int additionalLocations = (int) Math.round(Math.pow(2, StudyLocationType.values().length - 1));
 
         for (StudyLocationType type : StudyLocationType.values())
         {